C:\ProgramData\Windows.Microsoft.Photos\current\Microsoft.exe

discovered 2026-07-08

Electron/Squirrel masquerade launcher (reported signed 'Exodus Movement, Inc.') launched hidden from a Photos-app masquerade directory.

APIThreat Intel Feed API · Confirmed malicious packages, campaigns and IOCs, piped into your stackExplore the API

C:\ProgramData\Windows.Microsoft.Photos\current\Microsoft.exe — IOC — SafeDep Threat Intelligence - Real-time Open Source Software Supply Chain Security