Does every second count? Time-based evolution of malware behavior in sandboxes