Files reported as "suspicious" were subject to which Antivirus check"?

Grayware refers to applications that are not malicious but can be intrusive or undesirable, not simply 'suspicious' in the context of a potential virus.

Files identified as an explicit 'virus' would typically match a known signature, not just be flagged as 'suspicious' by heuristic means.

Sandbox analysis is a separate process where suspicious files are executed in an isolated environment to observe their behavior, which might be triggered *after* initial heuristic detection, but 'heuristic' is the direct check that *reports* them as suspicious without execution.

Heuristic scanning is an advanced Antivirus technique that analyzes the behavior and characteristics of files to detect unknown, zero-day, or polymorphic malware that might not match existing signatures. When a file exhibits suspicious behavior but doesn't exactly match a known virus signature, it's often flagged as 'suspicious' by the heuristic engine.