A malicious file themed around the AltPlanet coin used a familiar EPS vulnerability to initiate the attack. The downloaded file was encrypted with 0xAA and identified in the excerpt as Manuscrypt. The listed command-and-control infrastructure includes dgjswgl.com/include/freelist.php and lfsyjk.com/include/listview.php, along with hashes for the document or payload artifacts. The evidence is useful for hunting EPS-based delivery, XOR-protected Manuscrypt payload retrieval, and the small set of associated C2 paths.