Like any other typical PoS malware, Pillowmint iterates a list of processes and process them two at a time. it uses the API OpenProcess() using the PROCESS_VM_READ and PROCESS_QUERY_INFORMATION flags to obtain a handle then reads the memory’s content via ReadProcessMemory() API two chunks at a time. Depending on the Pillowmint version, it may encrypt the stolen CC data with AES encryption algorithm + Base64. This is then written to a file named "ldb_e.log" in Windows System directory