Please help to identify the following description belonging to which technique in MITRE and the corresponding tactics: Milan has saved files prior to upload from a compromised host to folders beginning with the characters `a9850d2f`.