The 2018 variants of MCMD have the added ability to upload files from the infected device. The file is taken from the path shown in Table 2 but is uploaded with a filename comprised of the current value of the GetTickCount API call plus the .dat file extension. Figure 5 shows the format used during the file upload performed via HTTPS POST, with the file transmitted as raw binary data