Vertex demonstrated a Synapse investigation beginning with a suspicious SHA256 file and enriching it through VirusTotal, MalwareBazaar, and MITRE ATT&CK data. The workflow connected the sample to Konni-tagged files, Korean tax-themed HWP and LNK lures, ttzcloud.com traffic, and the IP address 88.119.169.96. The article is useful as a practical investigation example for pivoting from one file hash into related DPRK-relevant infrastructure and malware context.