Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: APT41 extracted user account data from the Security Account Managerr (SAM), making a copy of this database from the registry using the <code>reg save</code> command or by exploiting volume shadow copies.