value:  Okrum loader only executes the payload after the left mouse button has been pressed at least three times in order to avoid being executed within virtualized or emulated environments. 
name: Virtualization/Sandbox Evasion: User Activity Based Checks