Crisp.exe creates scheduled task job file via mstask.dll to relaunch AlphVector.exe

Ethan Andrews@eandrews

•updated Jul 2, 2026•2•0•7

Detects the process Crisp.exe creating a legacy AT-style scheduled task job file in the C:\Windows\Tasks directory while simultaneously loading mstask.dll. This behavior is indicative of persistence establishment, specifically associated with the Operation Turb00 HijackLoader sideloading chain which utilizes legacy task scheduling to re-execute AlphVector.exe.