Nefilim uses the following  ‘timeout’ command to delay the execution of the ‘del’ command. Adversaries use this command also to evade sandbox analysis. C:\Windows\System32\cmd.exe" /c timeout /t 3 /nobreak"