PlugX Potential Removable Media Interaction

Kaung Khant Ko@kaungkhantko

•updated Sep 19, 2026•8•0•4

Detects removable-media/storage interaction events initiated by the PlugX side-loaded process chain (GRrte.exe / Jarte.exe), consistent with the PlugX core's drive-type query and removable-media ejection behavior (GetDriveTypeW / DeviceIoControl)