Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: T9000 can take screenshots of the desktop and target application windows, saving them to user directories as one byte XOR encrypted .dat files.