After detecting the removable USB volume drive, the PlugX variant creates a hidden folder with name “RECYCLE.BIN” and copies the EXE file, the loader DLL, and encrypted DAT file. Then, it hides all of the folders in the root directory and creates LNK for each one in order to deceive the victim to click on the LNK files