Check out my post for @Mandiant “Tearing through the Registry with python-registry” https://blog.mandiant.com/archives/1827