ResiLoader .NET NativeAOT Loader Execution Lacking CLR Dependencies

Ibrahim Saud@tektrix

•updated Jul 3, 2026•0•0•1

Detects the execution of 'ResiLoader.exe' in an environment where it does not load standard .NET runtime dependency modules (e.g., clr.dll, coreclr.dll). This behavior is characteristic of loaders attempting to obfuscate their .NET nature or executing in a manner that bypasses standard managed code monitoring.