has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file.  has also used reg save on the SYSTEM file Registry location to help extract the NTDS.dit file.
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file.  has also used reg save on the SYSTEM file Registry location to help extract the NTDS.dit file. ### Response: T1003.003.