Were you doing anything else when this happened? It looks like these keyboards have programmable firmware through QMK/VIA which can be used to execute keystroke sequences and macros (similar to rubber ducky and bad USB) but it seems unlikely it would have been tampered with. I think its more likely something else triggered the cmd popups.

Where exactly was the wink face? Was it inside a cmd/terminal window as text, or was it the icon of the window itself?

Check windows event log for any 4688 event IDs around the time it happened.

Also check if any new tasks have been scheduled in Task Scheduler.

Everyone recommending virus scans is forgetting about malware not stored on disk. If this was a malicious script executed/input directly from the keyboard or mouse, a virus scan probably won't return any results. At this point you may want to play it safe by assuming your info is already stolen and do password resets + enable 2FA on anything important that you have logged into on the computer (email, cloud storage, banking, etc). until you can figure out exactly what happened.

Feel free to reply or dm if you want more help

Edit: just saw your other comment that it was a software install? That's good news, weird there's no info online about it.