Morning Wave

Mercur Retail LLP is a retail chain. An employee reported a suspicious message to the help desk. The question you need to answer is not 'is it suspicious' but 'how many mailboxes received it'.

That distinction matters: reach determines what happens next. One message means a conversation with one person. Ten mailboxes means a company-wide notice, a check of every workstation and work on the mail gateway.

You have a day's export of messages across all mailboxes in the domain mercur-retail.example. The messages carry envelopes, check results and attachments with hashes.

Subjects and display names are in Russian, as in the real environment.