540c6

A new link appeared in my startup folder this morning "540c6". It points to C:\Windows\System32\cmd.exe /C start "" "C:\Users\JEB1\AppData\Roaming\c1a6f\ada5a.8b8c5e". I deleted it and it reappeared after 5 seconds.