Electron runtime binary which runs the Teams application
Generate JavaScript payload and package.json, and save to “%LOCALAPPDATA%\Microsoft\Teams\current\app\” before executing.
teams.exe
Execute JavaScript code
Generate JavaScript payload and package.json, archive in ASAR file and save to “%LOCALAPPDATA%\Microsoft\Teams\current\app.asar” before executing.
teams.exe
Execute JavaScript code
Teams spawns cmd.exe as a child process of teams.exe and executes the ping command
teams.exe --disable-gpu-sandbox --gpu-launcher="{CMD} &&"
Executes a process under a trusted Microsoft signed binary