A SOC analyst at Contoso receives threat intelligence indicating a new malware campaign is distributing a weaponized document with a known SHA256 hash via email. The analyst needs to determine which mailboxes received the malicious attachment and correlate that with whether any of those attachments were later written to disk on managed endpoints. Which pair of Advanced Hunting tables in Microsoft Defender XDR should the analyst join to answer both questions in a single query?