GPLControl.exe was observed in the real infection pattern that led to ANTÍDOTO, associated with startup persistence in Windows.
Where it appeared in the analyzed pattern
In the incident studied, the file appeared at C:\Users\Public\Libraries\GPLControl.exe and was associated with a user startup entry. Location and persistence were important parts of the context.
Relationship to the USB sample
In the analyzed sample, GPLControl.exe matched the same known SHA-256 as USB-Explorer.exe:3F3E84744C41D44CE8EC2CBBB6E97B837B5EA9E18CADEE57781497AD23D80E09
Why persistence matters
Deleting shortcuts from the USB drive does not solve the problem if Windows continues to start a component that contaminates removable drives again. This is why a specialized scan must inspect the system as well as the external drive.
How ANTÍDOTO interprets the finding
A name, missing signature or suspicious location are clues, not standalone verdicts. The engine combines those signals with known hashes, persistence and supported propagation patterns.
Do not delete files merely because a name looks similar. Confirm indicators and keep backups before destructive actions.
Scan first. Decide after.
ANTÍDOTO shows the detected indicators before removal.