Suspicious Registry Hive Dump

any where 
 (
  (event.category == "registry" and event.action == "save" and registry.path : ("HKLM\\SAM", "HKLM\\security", "HKLM\\SECURITY\\Policy\\Secrets") and
   not (process.executable : "?:\\Windows\\System32\\svchost.exe" and
        process.thread.Ext.call_stack_summary == "ntdll.dll
| regsvc.dll
| rpcrt4.dll
| kernelbase.dll
| ntdll.dll
| kernel32.dll
| ntdll.dll")) or
  
  (event.category == "file" and file.Ext.header_bytes like "72656766*" and file.size >= 20000 and 
   process.thread.Ext.call_stack_summary like "*advapi32.dll
| Unbacked*" and  
   _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*advapi32.dll!RegSaveKey*") and 
   _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "Unbacked*" and $entry.callsite_trailing_bytes : "?*"))
  ) and 
  process.executable != null and
  not (process.code_signature.subject_name == "VS REVO GROUP OOD" and process.code_signature.trusted == true) and
  not process.executable : ("?:\\Program Files\\Commvault\\ContentStore\\Base\\CLBackup.exe",
                            "?:\\Program Files (x86)\\Commvault\\ContentStore\\Base\\CLBackup.exe",
                            "?:\\Program Files\\VS Revo Group\\Revo Uninstaller Pro\\RevoUninPro.exe", 
                            "?:\\Program Files (x86)\\VS Revo Group\\Revo Uninstaller Pro\\RevoUninPro.exe", 
                            "?:\\Program Files (x86)\\IObit\\Advanced SystemCare\\ASC.exe",
                            "?:\\Program Files\\IObit\\Advanced SystemCare\\ASC.exe",
                            "?:\\Program Files\\Carbonite\\Replication\\DoubleTake.exe", 
                            "?:\\Program Files (x86)\\Carbonite\\Replication\\DoubleTake.exe",
                            "C:\\Program Files\\Microsoft SQL Server\\*\\Setup Bootstrap\\Release\\x64\\setup*.exe")