Cisco Secure Endpoint quarantines files from signed Windows installer
Open
@brennanb2025 is already working on this.
Since Aug 12, 2026.
bug
os:Windows
- Dominant language
- TypeScript
- Stars
- 72.1k
- Forks
- 4.7k
- Avg merge
- 14h 54m
- Merged PRs (30d)
- 520
Description
Operating system
Windows Enterprise 25H2, build 26200.8655, x64
Orca version
v1.4.126
Details
Cisco Secure Endpoint 8.5.0.30551 quarantines files extracted by the signed Windows installer. Winget reports a successful installation, but resources/app.asar is removed and Orca exits with code 1 about one second after launch.
I installed Orca with:
winget install --id StablyAI.Orca --exact --source winget
After installation:
- Launching
%LOCALAPPDATA%\Programs\orca\Orca.exeexits with code 1 after about one second. %LOCALAPPDATA%\Programs\orca\resources\app.asaris missing, whileapp.asar.unpackedremains.- Reinstalling with
--forcegives the same result.
Cisco Secure Endpoint records Event ID 1300 (detection), followed by Event ID 1310 (successful quarantine):
| Extracted component | Cisco detection |
|---|---|
<nsis-temp>\7z-out\resources\app.asar |
Clam.OpenClaw.Tool.OpenclawStateDir.UNOFFICIAL |
<nsis-temp>\app-64.7z |
Gen:Variant.Yogi.20533 |
<nsis-temp>\7z-out\resources\node_modules\node-pty\build\Release\conpty_console_list.node |
Gen:Variant.Yogi.20533 |
%LOCALAPPDATA%\Programs\orca\resources\app.asar |
Clam.OpenClaw.Tool.OpenclawStateDir.UNOFFICIAL |
Installer details:
- URL: https://github.com/stablyai/orca/releases/download/v1.4.126/orca-windows-setup.exe
- SHA-256:
E8ED422EFF7195B58ABF1C5D822BD519AFF53F7268F0ACF1AAC7B6E53C5265AF - Authenticode status: Valid
- Signer:
SignPath Foundation - The SHA-256 matches the Winget manifest for
StablyAI.Orcav1.4.126.
Could you investigate these detections in the Windows release?
Possibly related: #890
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.