 It isolates the suspicious program or piece of code inside a specialized virtual machine — or sandbox — and gives the antivirus program a chance to test the code and simulate what would happen if the suspicious file was allowed to run.It examines each command as it's activated and looks for any suspicious behaviors, such as self-replication, overwriting files, and other actions that are common to viruses.Potential Issues are reported to the user.