(Image:\\pypykatz.exe OR Image:\\python.exe) (CommandLine:live* CommandLine:registry*)