Relocate Malware

After payload delivery, adversaries may copy malware to a new location to remove evidence of their presence or avoid defenses. They may rename a copy to blend into the local environment, target file/path exclusions, or place it in a path associated with persistence. Deleting an earlier copy is a separate cleanup action. Relocation can complicate analysis; moving a file does not by itself change its creation timestamp.