Synapse Consulting - Lab Challenge #07 - Educational sample
===========================================================

  SYNAPSE LABS  |  EDUCATIONAL MATERIAL
  For education purposes only.

Synthetic Windows log export of a ClickFix (fake-CAPTCHA) incident on
NORTHSEA-DEV. No real malware, no real host: the C2 domains are
non-resolvable .invalid names (RFC 2606).

Files:
  RunMRU.reg                                   Run dialog history (what the user pasted)
  Microsoft-Windows-PowerShell%4Operational-4104.csv   Script Block Logging (deobfuscated)
  Sysmon-process-network.csv                   process creation + network connections

Goal: reconstruct the ClickFix chain, decode the -EncodedCommand, find the
download cradle and C2, and map it to ATT&CK.
Full walkthrough: https://www.synapse-consulting.eu/labs/
