Ip_bernardoorig_set30.rar -

Calculate the MD5 and SHA-256 hashes. These serve as a "fingerprint" to check if the file has been seen by services like VirusTotal.

Document every file inside the .rar . Look for unusual extensions like .exe , .vbs , or .bat hidden among documents. IP_BernardoORIG_Set30.rar

Watch for attempts to connect to remote Command & Control (C2) servers. Calculate the MD5 and SHA-256 hashes

Before opening the archive, document its external properties to ensure integrity. IP_BernardoORIG_Set30.rar