Sticky key sethc file failed replacement

Detects scenarios where an attacker failed to replace the original sethc.exe file by cmd.exe.