(Image:\\cmd.exe OR OriginalFileName:Cmd.Exe) (CommandLine:mklink* CommandLine:\\osk.exe* CommandLine:\\cmd.exe*)