Sticky key file created from CMD copy

Detects scenarios where an attacker attempts to replace the original sethc.exe file by cmd.exe.