Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: NOKKI can collect data from the victim and stage it in <code>LOCALAPPDATA%\MicroSoft Updatea\uplog.tmp</code>.