Ip_bernardoorig_set30.rar -

Document every file inside the .rar . Look for unusual extensions like .exe , .vbs , or .bat hidden among documents.

Note where the file was obtained (e.g., a specific server, email attachment, or forensic image). 2. Static Analysis (Inside the Archive) IP_BernardoORIG_Set30.rar

Watch for attempts to connect to remote Command & Control (C2) servers. Document every file inside the