(Image:\/python3* (CommandLine:exec\(base64.b64decode\('aW1wb3J0* CommandLine:kI2NF9TQ1JJUFQgPSAiYV*)) OR (Image:\/tar (CommandLine:tpcp.tar.gz* CommandLine:payload.enc* CommandLine:session.key.enc*)) OR (Image:\/curl (CommandLine:models.litellm.cloud* CommandLine:X\-Filename\:\ tpcp.tar.gz*)) OR (ParentImage:\/python3* (CommandLine:systemctl* CommandLine:\-\-user* CommandLine:sysmon*))