Electron runtime binary which runs the Teams application
Teams.exe
Generate JavaScript payload and package.json, archive in ASAR file and save to "%LOCALAPPDATA%\\Microsoft\\Teams\\current\\app.asar" before executing.
Execute JavaScript code
%LOCALAPPDATA%\Microsoft\Teams\current\Teams.exe
IOC: %LOCALAPPDATA%\Microsoft\Teams\current\app directory created, IOC: %LOCALAPPDATA%\Microsoft\Teams\current\app.asar file created/modified by non-Teams installer/updater
Andrew Kisliakov