I've extracted objects (JPEGs) from processes` memory dumps (obtained with memdump command from volatility framework) and got strange results after searching the memory pages of the main thread of chrome browser. Some extracted images are very small (212x132 pixels) print-screens of the chrome window, and seem to be taken at random moments, on different sites.
- Is it possible to have a trojan that tries to capture browser images, maybe searching for un-sniffable fields (like the ones filled with a virtual keyboard at bank logins)?
- If so, why are those print-screens in chrome's memory pages?
- Is there an explanation for a legit purpose?