V2 Nuget Build Dat Loader Reference
Detects a .NET-hosting PE module (e.g. I++u.dll) that references both the NuGet-package-concealed Build.dat loader stage and the subsequent execute_engine_disconnect.raw decrypted container, matching the V2 ClickFix loader chain
YARA
