Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file. Mustang Panda has also used <code>reg save</code> on the SYSTEM file Registry location to help extract the NTDS.dit file.