Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: Volt Typhoon has saved stolen files including the ntds.dit database and the `SYSTEM` and `SECURITY` Registry hives locally to the `C:\Windows\Temp\` directory.