I'm a bit confused about how Spectrum handles file analysis with regard to accessing services via the cloud. I know that when a file is analyzed, there is an option to send the md5 hash of that file to virustotal (for example) for searching their database. What I don't know is where that file gets hashed. Does spectrum first upload the file to the cloud, then hashing it there and sending that hash to virustotal? Or, does spectrum hash the file first and only send the hash to the cloud?
Asked in another way: when using a service like virustotal via the NW cloud, what exactly does our local spectrum appliance send to the cloud?