I had been using the Opera browser in VPN mode when it downloaded an alleged FlashPlayer.dmg file. I was suspicious because Flash was already up to date on that Mac. Suspicion justified, as soon as I mounted the virtual volume, Sophos Home app detected it as a nasty piece of shit, calling itself "InstallMe." I got Sophos to remove the threat. So Sophos unmounted the volume, leaving me to remove the spurious disk image.