el que

I've got a really silly idea for malware. Windows 11 now have Windows.Graphics from the Windows Runtime API. You can use it for taking screenshots. It's supposed to be better than the native WINAPI method because something about GPU rendering stuff, I don't know, I can't remember. Anyway Windows 11 also ships with an OCR library from the Windows-something-something in the WinRT as part of their AI stuff. The point being: I think I can take a fancy screenshot of an application, like Slack, Microsoft Teams, or Discord, using WinRT then use WinRT to OCR it into readable and parseable text from C/C++ It is basically a really convoluted way to do keylogging or espionage, or whatever. For extra flavor, use WinRT to upload the OCRd text to a remote host. Why do this instead of WinHTTP or Windows Sockets? Literally no reason other than curiosity. I have no idea how this would appear under the scope of an EDR. Sometimes you need to try silly things.