What’s actually happening?
This usually comes down to how antivirus and other security tools work. Many modern security products automatically upload unfamiliar executables (like the Gorelo RMM Agent installer) to cloud-based sandbox environments for analysis. When that sandbox runs the executable, the agent is installed and shows up in your list of assets.How to spot assets created by sandboxing
When unknown assets appear, they’re often the result of anti-malware vendors testing the Gorelo RMM Agent in sandbox environments. Unfortunately, these vendors don’t publish naming conventions for their test machines, so identifying them isn’t always straightforward. That said, there are a few common signs that an asset was created during automated AV/EDR testing:What to look for
Even if your antivirus or EDR solution doesn’t use offsite sandbox testing, mystery assets can still appear if someone uploads the Gorelo RMM Agent installer to an online malware scanner.
For example, tools like VirusTotal let you upload files to scan across dozens of antivirus engines. If a teammate, security vendor, or anyone with access to your installer does this, it can trigger the agent to run in a sandbox — and that can create a new asset.