======================================================================
  VALLEY WIDE PLASTERING - BEC INVESTIGATION
  Date: 2026-03-05 15:50:52 UTC
======================================================================

[*] Acquiring access token...
[OK] Token acquired successfully

======================================================================
  STEP 1: ALL TENANT USERS
======================================================================
  [ENABLED] Accounts Payable | acctpay@valleywideplastering.com | ID: e70d7ec5-72f3-4b80-9614-e6bd5380b773 | Created: 2023-03-17T21:33:24Z
  [ENABLED] Adolfo Suarez | adolfos@valleywideplastering.com | ID: aff7fcb9-a0e6-4298-8abb-2f538aa95ac8 | Created: 2023-03-17T21:34:03Z
  [ENABLED] Billing Clerk | billing@valleywideplastering.com | ID: 4f708b80-e537-4f63-92d3-5feedfa28244 | Created: 2023-03-17T21:35:41Z
  [ENABLED] Toni | billing@valleywideplastering.onmicrosoft.com | ID: 9bf0abb0-b613-4e1d-ba4d-b4e51a69ca3f | Created: 2023-01-13T19:40:34Z
  [ENABLED] Brian | Brian@valleywideplastering.com | ID: 5555cf28-f669-40f2-8a87-7ef73861f2f7 | Created: 2024-08-23T16:30:32Z
  [ENABLED] Carlos Reyes | carlos@valleywideplastering.com | ID: 8709d6c8-48af-4b3c-acee-2f16bd60e3d8 | Created: 2023-03-17T21:36:05Z
  [ENABLED] Charlie Jones | charlie@valleywideplastering.com | ID: b494cc30-5fd5-446e-aa29-d6bc1c5df015 | Created: 2025-12-24T20:13:02Z
  [ENABLED] Chris Guerrero | chris@valleywideplastering.com | ID: 55464175-3426-448a-af92-a47ef64c5104 | Created: 2023-11-29T13:49:34Z
  [ENABLED] Customer Service | customerservice@valleywideplastering.com | ID: 85125767-037c-410e-bc79-ae6110eee8b4 | Created: 2023-03-17T21:36:34Z
  [ENABLED] Customer Service | customerservice@valleywideplastering.onmicrosoft.com | ID: 2dc7a257-f415-4f92-affa-a59fd51920fc | Created: 2023-01-30T18:32:45Z
  [ENABLED] Bart Graffin | estimating@valleywideplastering.com | ID: 115a1d25-ba9b-492d-b095-1b8f0207d0a5 | Created: 2023-03-17T21:35:18Z
  [ENABLED] Fax Inbox | faxinbox@valleywideplastering.com | ID: f19426ea-42df-40ab-a7b5-725a0a46e508 | Created: 2023-03-17T22:03:48Z
  [ENABLED] Fermin Matta | fermin@valleywideplastering.com | ID: 38c353d3-1667-463b-89ae-a9960175dbb3 | Created: 2025-12-24T20:16:00Z
  [ENABLED] Francisco Arias | franciscoa@valleywideplastering.com | ID: a90877f8-238d-478e-9c45-9090dfdba12f | Created: 2023-03-17T21:37:38Z
  [ENABLED] VWP Insurance | insurance@valleywideplastering.com | ID: 6d5ff148-9cb0-40ea-86b5-b725a0fbdcc8 | Created: 2024-08-14T14:27:41Z
  [ENABLED] Issac Chavez | isaacc@valleywideplastering.com | ID: af5519d2-d855-4b7b-8f57-85ee843f58ef | Created: 2023-03-17T21:38:40Z
  [ENABLED] JR Guerrero | j-r@valleywideplastering.com | ID: 0af923d0-48c5-4cc1-8553-c60625802815 | Created: 2023-03-17T21:51:35Z
  [ENABLED] Jaime Hernandez | jaimebh@valleywideplastering.com | ID: 16388457-2f1b-44d0-8fc6-a4343a779f80 | Created: 2023-03-17T21:39:14Z
  [ENABLED] Jesse Guerrero | jesse@valleywideplastering.com | ID: ac669421-ee6d-4ea3-a293-341cb93cb6fd | Created: 2023-03-17T21:39:40Z
  [ENABLED] JR Guerrero | jr@CASARICA.NET | ID: 330931be-21f2-41ca-872b-f883ebe4ec45 | Created: 2023-03-17T21:50:37Z
  [ENABLED] Juan Leal | juan@valleywideplastering.com | ID: 570d3e5c-515d-4bf5-bae6-2c9b816025fb | Created: 2023-03-17T21:52:04Z
  [ENABLED] Kayla Guerrero | kayla@valleywideplastering.com | ID: cf165bab-a876-4a8a-87b2-9a5a0de3cefe | Created: 2025-07-10T17:05:48Z
  [ENABLED] Orders VWP | orders@valleywideplastering.com | ID: 3739c527-f156-49b7-8779-a19033564a0f | Created: 2023-03-17T21:54:40Z
  [ENABLED] Payroll VWP | payroll@valleywideplastering.com | ID: 9671837f-eaf5-46aa-9677-dbed40f8517e | Created: 2023-03-17T21:55:29Z
  [ENABLED] Ron Winger | ron@valleywideplastering.com | ID: 779fc914-3053-47c2-b5b4-5696d4c40a2d | Created: 2024-10-17T23:22:37Z
  [ENABLED] Rose Guerrero | rose@valleywideplastering.com | ID: 8c1e798c-26d9-43aa-a129-573aad703e6f | Created: 2023-03-17T21:56:42Z
  [ENABLED] Ryan Guerrero | ryan@valleywideplastering.com | ID: f83d4a9e-e431-4e4f-ac4d-50bf10112e26 | Created: 2023-03-17T21:57:05Z
  [ENABLED] Sammy Montijo | sammy@valleywideplastering.com | ID: 690d7044-d0f5-44b7-9654-c39652de7973 | Created: 2023-03-17T21:57:49Z
  [ENABLED] Shelly Dooley | shelly@valleywideplastering.com | ID: da8f7037-450d-4631-8a9b-dace75772003 | Created: 2023-07-12T18:12:00Z
  [ENABLED] Spro VWP | spro@valleywideplastering.com | ID: 27e20a2c-3e79-45d8-8542-4f7e5f56003b | Created: 2023-03-17T21:58:52Z
  [ENABLED] Computer Guru | sysadmin@valleywideplastering.com | ID: 41810f2d-b674-47ee-9b6f-f3ba69a7703d | Created: 2024-05-10T18:26:04Z
  [ENABLED] Teresa Carpio | teresa@valleywideplastering.com | ID: 615d8ef9-e3cc-49a8-bd56-19921cafea4e | Created: 2023-03-17T21:59:28Z
  [ENABLED] Ty Fetters | Ty@CASARICA.NET | ID: 2e6e0a06-cb8a-4cc2-8870-9a87f202e635 | Created: 2023-03-17T22:01:54Z

[INFO] Exact match for 'jrguerrero' not found, searching by name...
  >>> TARGET USER FOUND: j-r@valleywideplastering.com (ID: 0af923d0-48c5-4cc1-8553-c60625802815)

======================================================================
  STEP 2: SIGN-IN LOGS (Last 14 Days)
======================================================================
  [WARNING] sign-ins v1.0: 
  [*] Trying beta endpoint...
  [WARNING] sign-ins beta: 
  No sign-in logs found (tenant may not have Azure AD P1/P2)

======================================================================
  STEP 3: RECENT SENT MAIL (Last 14 Days)
======================================================================
               2026-03-05T14:38:37Z | To: orders@valleywideplastering.com | Subject: RE: starlight - sunset farm
  [SUSPICIOUS] 2026-03-05T14:37:35Z | To: Pedro.Pagazani@umb.com, lauriemg943@gmail.com | Subject: RE: Account
               Preview: Pedro, I apologize I have not had a chance to stop by.  I will make time today.





From: Pagazani, Pedro <Pedro.Pagazani@umb.com>

Sent: Wednesday, 
               2026-03-04T21:06:31Z | To: orders@valleywideplastering.com | Subject: Re: starlight - sunset farm
               2026-03-04T21:04:59Z | To: Dan.Surek@Pulte.com | Subject: RE: Harvest lot 2724 [HAS ATTACHMENTS]
               2026-03-04T19:51:01Z | To: Dan.Surek@Pulte.com, Brian@valleywideplastering.com, customerservice@valleywideplastering.com | Subject: RE: Harvest lot 2724
               2026-03-04T19:21:33Z | To: billing@valleywideplastering.com, orders@valleywideplastering.com, teresa@valleywideplastering.com | Subject: RE: Stack
               2026-03-04T19:08:03Z | To: customerservice@valleywideplastering.com | Subject: RE: Harvest Lot 27-24
               2026-03-04T19:07:37Z | To: Dan.Surek@Pulte.com, Brian@valleywideplastering.com, customerservice@valleywideplastering.com | Subject: Harvest lot 2724
               2026-03-04T18:23:31Z | To: ccowley@senecaapi.com, fermin@valleywideplastering.com, carlos@valleywideplastering.com | Subject: RE: Drew Residence 
               2026-03-04T18:18:34Z | To: orders@valleywideplastering.com, teresa@valleywideplastering.com | Subject: FW: Legado West 4000
               2026-03-04T18:10:28Z | To: acctpay@valleywideplastering.com | Subject: FW: Pulte h.  Vistoso cayon lot 28 ( Jesus serna ( [HAS ATTACHMENTS]
               2026-03-04T18:06:19Z | To: jerry@cookarch.com, loon@cookarch.com | Subject: RE: FWD: RE: re[4]: FW: VW Plastering 257220
               2026-03-04T17:58:43Z | To: CamA@cameron-custom.com, fermin@valleywideplastering.com | Subject: RE: Dew Residence Mock Up (Exterior Scheme Expression)
  [SUSPICIOUS] 2026-03-04T17:49:05Z | To: mark@reliableglassaz.com, jr@CASARICA.NET, chris@valleywideplastering.com | Subject: RE: Office TI Estimate - Drawings Attached
               Preview: I have a 9am and it may run over an hour let’s do10:30AM

Here at the location or your location.



JR



From: Mark Hoeffner <mark@reliableglassaz.co
               2026-03-04T16:17:37Z | To: franciscoa@valleywideplastering.com, teresa@valleywideplastering.com | Subject: HOUSES THAT WE ARE REDOING DUE TO CRACKS
               2026-03-04T13:23:16Z | To: acctpay@valleywideplastering.com | Subject: FW: Your Sunbelt Rental Statement [HAS ATTACHMENTS]
  [SUSPICIOUS] 2026-03-04T13:13:49Z | To: mark@reliableglassaz.com, chris@valleywideplastering.com | Subject: RE: Office TI Estimate - Drawings Attached
               Preview: Hi Mark what time on Thursday?



From: Mark Hoeffner <mark@reliableglassaz.com>

Sent: Tuesday, March 3, 2026 8:53 PM

To: Chris Guerrero <chris@vall
               2026-03-03T22:13:29Z | To: franciscoa@valleywideplastering.com | Subject: Re: Mattamy Homes Covena Pointe at Rocking K New Community Bid Invite - RFP - Please READ and RESPOND! 
               2026-03-03T18:44:01Z | To: billing@valleywideplastering.com | Subject: Fw: Mattamy Homes Covena Pointe at Rocking K New Community Bid Invite - RFP - Please READ and RESPOND! 
               2026-03-03T14:02:54Z | To: juan@valleywideplastering.com | Subject: Fw: 470 N. 56th st. Chandler AZ 85226
               2026-03-03T12:44:07Z | To: tkkossdevco@gmail.com | Subject: Re: 470 N. 56th st. Chandler AZ 85226
               2026-03-03T01:51:39Z | To: Heath.Thompson@Pulte.com, chris@valleywideplastering.com | Subject: Arrowhead rifles
               2026-03-03T01:31:01Z | To: Heath.Thompson@Pulte.com, chris@valleywideplastering.com | Subject: Tripod with magentic release
               2026-03-02T23:23:36Z | To: hunter@rbwilliams.com | Subject: Re: Valley-wide plastering
               2026-03-02T21:35:06Z | To: jesse@valleywideplastering.com | Subject: Fw: Walters Residence [HAS ATTACHMENTS]
               2026-03-02T18:24:42Z | To: ron@valleywideplastering.com, orders@valleywideplastering.com, teresa@valleywideplastering.com | Subject: Fw: Bid Invitation: Sunset Farms - Starlight Homes [HAS ATTACHMENTS]
               2026-03-02T16:47:02Z | To: ccowley@senecaapi.com, fermin@valleywideplastering.com, carlos@valleywideplastering.com | Subject: RE: Drew resindence
               2026-03-02T16:16:12Z | To: rose@valleywideplastering.com, lauriemg943@gmail.com | Subject: FW: 13632004 MULTI
               2026-03-02T13:56:05Z | To: loon@cookarch.com | Subject: FW: PROJECT SCOPING MEETING: T3709494 - VALLEY WIDE PLASTERING, INC. - LJ115024 - ZD281324 - 20 1/16E  4 13/16S [HAS ATTACHMENTS]
               2026-03-02T13:47:59Z | To: Derien.Runnels@catamountinc.com | Subject: Accepted: Flats at Ballpark - Valley Wide Plastering Site Visit
               2026-03-01T18:31:04Z | To: jr@CASARICA.NET | Subject: 
               2026-03-01T00:28:49Z | To: Elisa.Torresdeleon@srpnet.com, loon@cookarch.com | Subject: Re: Scheduling Project Scoping Meeting - T3709494 - VALLEY WIDE PLASTERING, INC.
               2026-03-01T00:23:41Z | To: jeff@rbwilliams.com, jesse@valleywideplastering.com, jarrington@yscpaving.com | Subject: Re: Request for Building Corner Offsets
               2026-02-28T14:02:02Z | To: Derien.Runnels@catamountinc.com, estimating@valleywideplastering.com | Subject: Re: Flats at Ballpark
               2026-02-28T13:55:43Z | To: Derien.Runnels@catamountinc.com, estimating@valleywideplastering.com | Subject: Re: Flats at Ballpark
               2026-02-27T21:55:12Z | To: michael.anaya@srpnet.com | Subject: RE: SRP Project Documents for SRP  WO# T3709494 - VALLEY WIDE PLASTERING, INC.
               2026-02-27T21:42:17Z | To: tkkossdevco@gmail.com | Subject: 470 N. 56th st.  Chandler AZ 85226 [HAS ATTACHMENTS]
               2026-02-27T20:07:36Z | To: rose@valleywideplastering.com | Subject: Fw: Noble Sea Warrior Feb 23 Expense Report [HAS ATTACHMENTS]
  [SUSPICIOUS] 2026-02-27T20:07:17Z | To: rose@valleywideplastering.com | Subject: Fw: Invoice #2061 From Jeanette Amacher Yacht Maintenance [HAS ATTACHMENTS]
               Preview: Get Outlook for iOS

________________________________

From: John Noble <johnsnoblejr@yahoo.com>

Sent: Monday, February 23, 2026 10:01:26 PM

To: JR 
               2026-02-27T20:06:23Z | To: Suzena.Breen@mattamycorp.com | Subject: Re: [EXTERNAL] RE: Mattamy Homes Covena Pointe at Rocking K New Community Bid Invite - RFP - Please READ and RESPOND! 
               2026-02-27T17:46:01Z | To: billing@valleywideplastering.com | Subject: Fw: Jzd Modera siding [HAS ATTACHMENTS]
               2026-02-27T16:42:55Z | To: sammy@valleywideplastering.com, franciscoa@valleywideplastering.com | Subject: FW: Mirador Point / Mirador Blossom / Mirador Skies Schedule 3-3-2026 [HAS ATTACHMENTS]
               2026-02-27T16:39:41Z | To: Suzena.Breen@mattamycorp.com | Subject: RE: Mattamy Homes Covena Pointe at Rocking K New Community Bid Invite - RFP - Please READ and RESPOND! 
               2026-02-27T13:01:13Z | To: isaacc@valleywideplastering.com, juan@valleywideplastering.com | Subject: 
  [SUSPICIOUS] 2026-02-26T23:09:26Z | To: rotm1969@gmail.com | Subject: Fw: Apartments invoice and contract [HAS ATTACHMENTS]
               Preview: Get Outlook for iOS

________________________________

From: Billing Clerk <billing@valleywideplastering.com>

Sent: Thursday, February 26, 2026 4:02 
  [SUSPICIOUS] 2026-02-26T22:59:18Z | To: billing@valleywideplastering.com | Subject: FW: Apartments invoice and contract [HAS ATTACHMENTS]
               Preview: From: Mark McKillip <rotm1969@gmail.com>

Sent: Thursday, December 11, 2025 8:07 PM

To: JR Guerrero <j-r@valleywideplastering.com>

Subject: Apartmen
               2026-02-26T22:12:42Z | To: Elisa.Torresdeleon@srpnet.com | Subject: RE: Scheduling Project Scoping Meeting - T3709494 - VALLEY WIDE PLASTERING, INC.
               2026-02-26T22:10:44Z | To: billing@valleywideplastering.com | Subject: FW: OH door In-Fill - Dates [Stucco - Valleywide] 
               2026-02-26T22:04:27Z | To: GAFlores@arizonatile.com, jr@CASARICA.NET, lamaro@arizonatile.com | Subject: RE: OA 14646360
               2026-02-26T21:51:41Z | To: estimating@valleywideplastering.com | Subject: RE: VWP - revised plans has been submitted to Chandler
               2026-02-26T21:49:33Z | To: sammy@valleywideplastering.com, franciscoa@valleywideplastering.com | Subject: FW: Mirador Point / Mirador Blossom / Mirador Skies Schedule 3-3-2026 [HAS ATTACHMENTS]
  [SUSPICIOUS] 2026-02-26T18:24:51Z | To: franciscoa@valleywideplastering.com, sammy@valleywideplastering.com, teresa@valleywideplastering.com | Subject: WIRE SHORTAGE
               Preview: Guys, we need to be checking lathers on wire .  The two houses we walked with Pulte, the wire had a minimum of 12” overlap X 3 runs on the perimeter o
               2026-02-26T18:13:08Z | To: sammy@valleywideplastering.com, franciscoa@valleywideplastering.com, teresa@valleywideplastering.com | Subject: SAND
               2026-02-26T14:43:18Z | To: ccowley@senecaapi.com, fermin@valleywideplastering.com, carlos@valleywideplastering.com | Subject: Drew resindence
               2026-02-26T02:08:21Z | To: chris@valleywideplastering.com | Subject: Fw: Extended Warranty Request & Follow up (Veridian Models) [HAS ATTACHMENTS]
               2026-02-25T22:42:22Z | To: patriotlanceaz@yahoo.com | Subject: RE: safety vests
               2026-02-25T21:42:09Z | To: robert@acsdoors.com, jesse@valleywideplastering.com | Subject: FW: VWP - revised plans has been submitted to Chandler
               2026-02-25T21:38:45Z | To: robert@acsdoors.com, jesse@valleywideplastering.com | Subject: FW: VWP - revised plans has been submitted to Chandler
               2026-02-25T21:37:22Z | To: robert@acsdoors.com, jesse@valleywideplastering.com | Subject: FW: VWP - revised plans has been submitted to Chandler
               2026-02-25T21:35:44Z | To: robert@acsdoors.com, jesse@valleywideplastering.com | Subject: FW: VWP - revised plans has been submitted to Chandler
               2026-02-25T21:24:42Z | To: estimating@valleywideplastering.com | Subject: FW: VWP - revised plans has been submitted to Chandler
               2026-02-25T21:21:26Z | To: justins@camelothomes.com | Subject: RE: Extended Warranty Request & Follow up (Veridian Models) [HAS ATTACHMENTS]
               2026-02-25T20:35:31Z | To: estimating@valleywideplastering.com, juan@valleywideplastering.com, jaimebh@valleywideplastering.com | Subject: Re: A2 East Elevation Metal Panel and MCRT Introduction
               2026-02-25T17:13:14Z | To: patriotlanceaz@yahoo.com, jesse@valleywideplastering.com | Subject: safety vests
               2026-02-25T16:35:43Z | To: jesse@valleywideplastering.com | Subject: king air
               2026-02-25T15:18:01Z | To: customerservice@valleywideplastering.com | Subject: RE: MVR 155 missing stucco
               2026-02-25T13:13:18Z | To: estimating@valleywideplastering.com | Subject: 10 year warranty
               2026-02-24T20:57:39Z | To: estimating@valleywideplastering.com, jesse@valleywideplastering.com, ron@valleywideplastering.com | Subject: RE: Homes to see finish
               2026-02-24T15:39:40Z | To: Heath.Thompson@Pulte.com, franciscoa@valleywideplastering.com, sammy@valleywideplastering.com | Subject: RE: Stucco in Tucson  BROWN COAT MONITORING PLAN
               2026-02-24T15:37:49Z | To: chris@valleywideplastering.com | Subject: FW: New vessel [HAS ATTACHMENTS]
               2026-02-24T15:36:46Z | To: jlfloden@cnicklausstarling.com, jesse@valleywideplastering.com, chris@valleywideplastering.com | Subject: USS SEA WARRIOR
               2026-02-24T15:00:43Z | To: capnjackv@hotmail.com, jesse@valleywideplastering.com | Subject: FW: New vessel [HAS ATTACHMENTS]
               2026-02-24T14:12:59Z | To: sammy@valleywideplastering.com, franciscoa@valleywideplastering.com, customerservice@valleywideplastering.com | Subject: BROWN COAT CRACK REPAIRS- ALL COMMUNITIES
               2026-02-24T13:12:34Z | To: gbonanni@mcrtrust.com, estimating@valleywideplastering.com, juan@valleywideplastering.com | Subject: RE: M10 Production
               2026-02-23T17:44:23Z | To: rfinn@ascentworks.com | Subject: Accepted: Valley Wide Pre-Renewal Meeting 
               2026-02-23T15:41:17Z | To: patriotlanceaz@yahoo.com | Subject: RE: Proofs
               2026-02-23T14:58:04Z | To: Heath.Thompson@Pulte.com, franciscoa@valleywideplastering.com, sammy@valleywideplastering.com | Subject: RE: Stucco in Tucson  BROWN COAT MONITORING PLAN
               2026-02-23T14:39:58Z | To: rfinn@ascentworks.com, jesse@valleywideplastering.com, shelly@valleywideplastering.com | Subject: RE: Valley Wide Plastering Pre Renewal Strategy Meeting 
               2026-02-23T14:20:55Z | To: chris@valleywideplastering.com, lauriemg943@gmail.com, jesse@nescoap.com | Subject: FW: Proofs [HAS ATTACHMENTS]
               2026-02-23T14:18:35Z | To: jeff@rbwilliams.com, jesse@valleywideplastering.com, jarrington@yscpaving.com | Subject: RE: Request for Building Corner Offsets
               2026-02-21T02:44:57Z | To: rtraica@ftlegal.com, Mike.George@opus-group.com, jr@CASARICA.NET | Subject: Re: Easement Closure Notification - Opus and Valley Wide Plastering
               2026-02-21T02:22:09Z | To: patriotlanceaz@yahoo.com | Subject: Re: Proof [HAS ATTACHMENTS]
               2026-02-20T05:08:53Z | To: patriotlanceaz@yahoo.com | Subject: Re: Hoodie Proof
               2026-02-19T23:19:39Z | To: ron@valleywideplastering.com | Subject: Fw: Bid Invite: Prasada East Shops and Whole Foods Project
               2026-02-19T19:46:04Z | To: patriotlanceaz@yahoo.com | Subject: Re: Hoodie Proof
               2026-02-19T19:36:46Z | To: billing@valleywideplastering.com, lauriemg943@gmail.com | Subject: Floor and Decor
               2026-02-19T14:20:14Z | To: billing@valleywideplastering.com | Subject: Carrie at Richmond 
               2026-02-18T22:43:50Z | To: customerservice@valleywideplastering.com | Subject: Re: Jemattel homes
               2026-02-18T22:37:31Z | To: customerservice@valleywideplastering.com | Subject: Jemattel homes
               2026-02-18T22:25:07Z | To: carlos@valleywideplastering.com | Subject: Fw: Pulte Homes Upper Canyon Trade Pre Construction Start Meeting Front End Trade Group [HAS ATTACHMENTS]
               2026-02-18T21:54:45Z | To: customerservice@valleywideplastering.com | Subject: Fw: Pulte Homes Upper Canyon Trade Pre Construction Start Meeting Front End Trade Group [HAS ATTACHMENTS]
               2026-02-18T19:43:50Z | To: chris@valleywideplastering.com, jr@CASARICA.NET | Subject: RE: [Reminder] Proposal for Valley Wide Plastering TI
               2026-02-18T19:41:30Z | To: joe.telles@jematellhomes.com, jdodson@ybcco.com, customerservice@valleywideplastering.com | Subject: RE: Crist Stucco/Door Punch
               2026-02-17T23:50:32Z | To: estimating@valleywideplastering.com, juan@valleywideplastering.com, jaimebh@valleywideplastering.com | Subject: Re: Faux Lintels at clubhouse
               2026-02-17T22:48:37Z | To: trent.jordan@aps.com, sara.foley@aps.com | Subject: RE: WA759416      370 N.  NEVADA ST
               2026-02-17T22:38:18Z | To: trent.jordan@aps.com, sara.foley@aps.com | Subject: WA759416      370 N.  NEVADA ST
               2026-02-17T21:33:09Z | To: estimating@valleywideplastering.com, juan@valleywideplastering.com, jaimebh@valleywideplastering.com | Subject: RE: Faux Lintels at clubhouse
               2026-02-17T21:16:08Z | To: sammy@valleywideplastering.com, franciscoa@valleywideplastering.com | Subject: FW: Mirador Point / Mirador Blossom / Mirador Skies Schedule 2-27-2026 [HAS ATTACHMENTS]
  [SUSPICIOUS] 2026-02-17T21:15:33Z | To: acctpay@valleywideplastering.com | Subject: FW: Invoice - Reminder: Your payment to SUNDANCE SWEEPING is due [HAS ATTACHMENTS]
               Preview: We need to pay this please.



From: SUNDANCE SWEEPING <sundancesweeping@gmail.com>

Sent: Tuesday, February 17, 2026 1:04 PM

To: JR Guerrero <j-r@va
               2026-02-17T18:36:31Z | To: Elisa.Torresdeleon@srpnet.com | Subject: RE: Scheduling Project Scoping Meeting - T3709494 - VALLEY WIDE PLASTERING, INC.

  --- Sent Mail Summary ---
  Total sent messages: 100
  Suspicious subjects: 8
  External recipients: 53
  External recipient list:
    - Brian.Davis@opus-group.com
    - CamA@cameron-custom.com
    - Cory.Garcia@Pulte.com
    - Dan.Surek@Pulte.com
    - David.Benjamin@opus-group.com
    - Derien.Runnels@catamountinc.com
    - Don.Vonderwell@opus-group.com
    - Elisa.Torresdeleon@srpnet.com
    - GAFlores@arizonatile.com
    - Heath.Thompson@Pulte.com
    - Jennifer.Moya@opus-group.com
    - Kallie.Tiller@srpnet.com
    - Lara.Bauerly@opus-group.com
    - Leo.Barros@Pulte.com
    - Luke.Eggers@opus-group.com
    - Matthew.Visnansky@opus-group.com
    - Mike.George@opus-group.com
    - OrderDeskTempe@arizonatile.com
    - Pedro.Pagazani@umb.com
    - Suzena.Breen@mattamycorp.com
    - capnjackv@hotmail.com
    - ccowley@senecaapi.com
    - david@jematellhomes.com
    - dprescott@ascentworks.com
    - gbonanni@mcrtrust.com
    - group-chandlerconstructiongroup@mcrtrust.com
    - hunter@rbwilliams.com
    - jarrington@yscpaving.com
    - jdodson@ybcco.com
    - jeff@rbwilliams.com
    - jerry@cookarch.com
    - jesse@nescoap.com
    - jlfloden@cnicklausstarling.com
    - jmarshall@marshallbrown.com
    - joe.telles@jematellhomes.com
    - jr@CASARICA.NET
    - justins@camelothomes.com
    - lamaro@arizonatile.com
    - lauriemg943@gmail.com
    - loon@cookarch.com
    - mark@reliableglassaz.com
    - mgittlein@ascentworks.com
    - michael.anaya@srpnet.com
    - patriotlanceaz@yahoo.com
    - rfinn@ascentworks.com
    - robert@acsdoors.com
    - rotm1969@gmail.com
    - rtraica@ftlegal.com
    - sara.foley@aps.com
    - shanrahan@ascentworks.com
    - tkkossdevco@gmail.com
    - trent.jordan@aps.com
    - tyler@jematellhomes.com

======================================================================
  STEP 4: INBOX RULES (CRITICAL CHECK)
======================================================================
  [OK] No inbox rules found

======================================================================
  STEP 5: MAILBOX SETTINGS (Forwarding & Auto-Reply)
======================================================================
  Auto-Reply Status: disabled
  [OK] Auto-replies are disabled
  Language: en-US
  Timezone: US Mountain Standard Time
  Date format: 

  Checking SMTP forwarding...
  Proxy addresses: ['smtp:jr@valleywideplastering.com', 'SMTP:j-r@valleywideplastering.com']
  Other emails: []

======================================================================
  STEP 6: AUTHENTICATION METHODS
======================================================================
  [passwordAuthenticationMethod] ID: 28c10230-6103-485e-b985-444c60001490
  [phoneAuthenticationMethod] ID: 3179e48a-750b-4051-897c-87b9720928f7 | Phone: +1 4807976102 (mobile)
  [microsoftAuthenticatorAuthenticationMethod] ID: eb72fea3-368c-4ac8-8bfa-fdc2d292a9cd | Device: iPhone 16 Pro Max | Created: None

======================================================================
  STEP 7: OAUTH PERMISSION GRANTS & THIRD-PARTY APPS
======================================================================
  [OK] No OAuth permission grants found for user

  Checking third-party service principals...
  [WARNING] service principals: Filter operator 'NotEqualsMatch' is not supported.
  No third-party service principals found or filter not supported

======================================================================
  STEP 8: DIRECTORY AUDIT LOGS (Recent Changes)
======================================================================
             2026-03-05T15:39:49.2102951Z | User deleted security info | Result: success | Actor: None
  [CRITICAL] 2026-03-05T15:39:49.1457845Z | Update user | Result: success | Actor: Azure Credential Configuration Endpoint Service
    Changed: StrongAuthenticationPhoneAppDetail: [{"DeviceName":"iPhone 12 Pro Max","DeviceToken":"apns2-bbdaed1230ccf93a47375c16 -> [{"DeviceName":"iPhone 16 Pro Max","DeviceToken":"apns2-cdb3e5cb2c5ce66a0a3fee50
    Changed: Included Updated Properties: None -> "StrongAuthenticationPhoneAppDetail"
    Changed: TargetId.UserType: None -> "Member"
  [CRITICAL] 2026-03-05T15:08:11.0443888Z | Update user | Result: success | Actor: sysadmin@valleywideplastering.com
    Changed: StsRefreshTokensValidFrom: ["2025-07-24T20:52:05Z"] -> ["2026-03-05T15:08:10Z"]
    Changed: Included Updated Properties: None -> "StsRefreshTokensValidFrom"
    Changed: TargetId.UserType: None -> "Member"
             2026-03-05T15:08:11.0433888Z | Update StsRefreshTokenValidFrom Timestamp | Result: success | Actor: sysadmin@valleywideplastering.com
             2026-03-05T15:08:04.9639776Z | Update StsRefreshTokenValidFrom Timestamp | Result: success | Actor: Microsoft password reset service
  [CRITICAL] 2026-03-05T15:08:04.9629772Z | Reset user password | Result: success | Actor: Microsoft password reset service
  [CRITICAL] 2026-03-05T15:08:04.9447954Z | Reset password (by admin) | Result: success | Actor: sysadmin@valleywideplastering.com
             2026-03-05T15:08:04.7639714Z | Update PasswordProfile | Result: success | Actor: Microsoft password reset service
  [CRITICAL] 2026-03-05T15:08:04.757972Z | Update user | Result: success | Actor: Microsoft password reset service
    Changed: StsRefreshTokensValidFrom: ["2025-07-24T20:52:05Z"] -> ["2026-03-05T15:08:04Z"]
    Changed: Included Updated Properties: None -> "StsRefreshTokensValidFrom"
    Changed: TargetId.UserType: None -> "Member"
             2026-03-05T15:08:04.5589806Z | Update PasswordProfile | Result: success | Actor: Microsoft password reset service
  [CRITICAL] 2026-03-04T18:56:23.1582355Z | Update user | Result: success | Actor: Azure MFA StrongAuthenticationService
    Changed: StrongAuthenticationPhoneAppDetail: [{"DeviceName":"iPhone 12 Pro Max","DeviceToken":"apns2-bbdaed1230ccf93a47375c16 -> [{"DeviceName":"iPhone 12 Pro Max","DeviceToken":"apns2-bbdaed1230ccf93a47375c16
    Changed: Included Updated Properties: None -> "StrongAuthenticationPhoneAppDetail"
    Changed: TargetId.UserType: None -> "Member"

======================================================================
  STEP 9: LATERAL MOVEMENT CHECK (All Users Risky Sign-ins)
======================================================================
  [OK] Accounts Payable (acctpay@valleywideplastering.com): No risky sign-ins detected
  [OK] Adolfo Suarez (adolfos@valleywideplastering.com): No risky sign-ins detected

  [SUSPICIOUS] Billing Clerk (billing@valleywideplastering.com):
    2026-03-04T11:24:04Z | IP: 69.49.112.75 | Country: CA | Risk: none | Protocol: Browser
    2026-03-03T15:22:58Z | IP: 141.8.200.245 | Country: AL | Risk: none | Protocol: Browser
  [OK] Toni (billing@valleywideplastering.onmicrosoft.com): No risky sign-ins detected
  [WARNING] risk check Brian@valleywideplastering.com: 
  [OK] Brian (Brian@valleywideplastering.com): No risky sign-ins detected

  [SUSPICIOUS] Carlos Reyes (carlos@valleywideplastering.com):
    2026-03-05T04:41:07Z | IP: 113.132.45.106 | Country: CN | Risk: none | Protocol: Browser
    2026-03-04T05:13:17Z | IP: 161.132.45.124 | Country: PE | Risk: none | Protocol: Browser
    2026-03-02T12:55:09Z | IP: 103.1.185.60 | Country: AU | Risk: none | Protocol: Browser
    2026-03-02T12:52:45Z | IP: 47.76.39.128 | Country: HK | Risk: none | Protocol: Browser
    2026-02-24T03:23:01Z | IP: 27.147.222.16 | Country: BD | Risk: none | Protocol: Browser
    2026-02-23T12:48:35Z | IP: 111.118.148.221 | Country: KH | Risk: none | Protocol: Browser
    2026-02-22T18:19:00Z | IP: 200.142.104.99 | Country: BR | Risk: none | Protocol: Browser
  [OK] Charlie Jones (charlie@valleywideplastering.com): No risky sign-ins detected

  [SUSPICIOUS] Chris Guerrero (chris@valleywideplastering.com):
    2026-03-04T08:37:18Z | IP: 46.243.3.58 | Country: NL | Risk: none | Protocol: Browser
    2026-03-04T05:03:58Z | IP: 64.188.124.97 | Country: DE | Risk: none | Protocol: Browser
    2026-03-04T04:48:48Z | IP: 103.178.194.93 | Country: ID | Risk: none | Protocol: Browser
    2026-03-02T23:31:12Z | IP: 65.20.149.252 | Country: IQ | Risk: none | Protocol: Browser

  [SUSPICIOUS] Customer Service (customerservice@valleywideplastering.com):
    2026-03-04T03:43:16Z | IP: 116.212.152.131 | Country: KH | Risk: none | Protocol: Browser
    2026-03-04T02:57:00Z | IP: 103.167.171.149 | Country: ID | Risk: none | Protocol: Browser
    2026-03-03T16:51:51Z | IP: 159.65.19.69 | Country: GB | Risk: none | Protocol: Browser
    2026-03-02T21:18:13Z | IP: 122.152.55.98 | Country: BD | Risk: none | Protocol: Browser
    2026-03-02T21:18:11Z | IP: 103.111.225.62 | Country: BD | Risk: none | Protocol: Browser
    2026-03-02T18:37:28Z | IP: 47.84.93.78 | Country: SG | Risk: none | Protocol: Browser
  [OK] Customer Service (customerservice@valleywideplastering.onmicrosoft.com): No risky sign-ins detected

  [SUSPICIOUS] Bart Graffin (estimating@valleywideplastering.com):
    2026-03-04T04:09:02Z | IP: 45.131.194.59 | Country: US | Risk: hidden | Protocol: Browser
  [WARNING] risk check faxinbox@valleywideplastering.com: 
  [OK] Fax Inbox (faxinbox@valleywideplastering.com): No risky sign-ins detected
  [OK] Fermin Matta (fermin@valleywideplastering.com): No risky sign-ins detected
  [OK] Francisco Arias (franciscoa@valleywideplastering.com): No risky sign-ins detected
  [OK] VWP Insurance (insurance@valleywideplastering.com): No risky sign-ins detected
  [OK] Issac Chavez (isaacc@valleywideplastering.com): No risky sign-ins detected
  [WARNING] risk check jaimebh@valleywideplastering.com: 
  [OK] Jaime Hernandez (jaimebh@valleywideplastering.com): No risky sign-ins detected

  [SUSPICIOUS] Jesse Guerrero (jesse@valleywideplastering.com):
    2026-03-04T18:25:09Z | IP: 157.90.211.189 | Country: DE | Risk: none | Protocol: Browser
    2026-03-04T11:59:08Z | IP: 212.172.50.128 | Country: DE | Risk: none | Protocol: Browser
    2026-03-04T06:40:42Z | IP: 159.65.19.147 | Country: GB | Risk: none | Protocol: Browser
    2026-03-04T05:31:39Z | IP: 103.56.163.133 | Country: VN | Risk: none | Protocol: Browser
    2026-03-03T10:10:49Z | IP: 45.87.251.172 | Country: NL | Risk: none | Protocol: Browser
    2026-03-02T19:07:45Z | IP: 179.189.233.174 | Country: BR | Risk: none | Protocol: Browser
    2026-03-02T15:33:42Z | IP: 125.213.199.22 | Country: AF | Risk: none | Protocol: Browser
    2026-03-01T03:26:43Z | IP: 202.62.39.221 | Country: KH | Risk: none | Protocol: Browser
    2026-03-01T02:08:20Z | IP: 119.94.113.81 | Country: PH | Risk: none | Protocol: Browser
  [OK] JR Guerrero (jr@CASARICA.NET): No risky sign-ins detected

  [SUSPICIOUS] Juan Leal (juan@valleywideplastering.com):
    2026-03-04T03:00:57Z | IP: 65.109.138.57 | Country: FI | Risk: none | Protocol: Browser
    2026-03-03T22:03:48Z | IP: 185.82.239.12 | Country: CZ | Risk: none | Protocol: Browser
    2026-03-03T14:13:20Z | IP: 177.234.208.59 | Country: EC | Risk: none | Protocol: Browser
    2026-03-03T10:53:28Z | IP: 95.107.173.106 | Country: AL | Risk: none | Protocol: Browser
    2026-03-02T20:03:11Z | IP: 118.179.175.158 | Country: BD | Risk: none | Protocol: Browser
    2026-03-02T19:07:39Z | IP: 220.87.3.141 | Country: KR | Risk: none | Protocol: Browser
    2026-03-02T16:06:16Z | IP: 157.254.20.246 | Country: HK | Risk: none | Protocol: Browser
    2026-03-02T15:33:28Z | IP: 3.38.214.6 | Country: KR | Risk: none | Protocol: Browser
    2026-02-24T05:29:55Z | IP: 161.117.183.222 | Country: SG | Risk: none | Protocol: Browser
  [OK] Kayla Guerrero (kayla@valleywideplastering.com): No risky sign-ins detected

  [SUSPICIOUS] Orders VWP (orders@valleywideplastering.com):
    2026-03-04T18:59:51Z | IP: 183.81.91.2 | Country: VN | Risk: none | Protocol: Browser
    2026-03-04T04:13:24Z | IP: 220.87.3.141 | Country: KR | Risk: none | Protocol: Browser
  [WARNING] risk check payroll@valleywideplastering.com: 
  [OK] Payroll VWP (payroll@valleywideplastering.com): No risky sign-ins detected

  [SUSPICIOUS] Ron Winger (ron@valleywideplastering.com):
    2026-03-04T13:38:09Z | IP: 170.246.176.222 | Country: AR | Risk: none | Protocol: Browser
    2026-03-04T04:39:21Z | IP: 138.252.89.1 | Country: AU | Risk: none | Protocol: Browser
    2026-03-04T02:12:09Z | IP: 117.121.202.245 | Country: ID | Risk: none | Protocol: Browser
    2026-03-03T12:58:26Z | IP: 54.179.157.31 | Country: SG | Risk: none | Protocol: Browser
    2026-03-03T12:58:05Z | IP: 190.122.145.20 | Country: AR | Risk: none | Protocol: Browser
    2026-03-02T12:58:20Z | IP: 103.244.107.140 | Country: ID | Risk: none | Protocol: Browser
    2026-03-01T17:21:23Z | IP: 189.32.23.70 | Country: BR | Risk: none | Protocol: Browser
    2026-02-28T21:18:40Z | IP: 211.226.137.4 | Country: KR | Risk: none | Protocol: Browser

  [SUSPICIOUS] Rose Guerrero (rose@valleywideplastering.com):
    2026-03-05T11:20:40Z | IP: 98.159.37.184 | Country: US | Risk: hidden | Protocol: Mobile Apps and Desktop clients
    2026-03-04T20:16:46Z | IP: 173.244.55.101 | Country: PE | Risk: hidden | Protocol: Mobile Apps and Desktop clients
    2026-03-04T17:16:14Z | IP: 2605:6400:c077:2126:aa5b:1086:fe18:8538 | Country: LU | Risk: none | Protocol: Mobile Apps and Desktop clients
    2026-03-04T14:53:32Z | IP: 2605:6400:c077:306e:9c9:c95e:c18a:6e43 | Country: LU | Risk: none | Protocol: Mobile Apps and Desktop clients
    2026-03-04T08:16:02Z | IP: 45.86.202.93 | Country: DE | Risk: hidden | Protocol: Mobile Apps and Desktop clients
    2026-03-04T07:46:16Z | IP: 152.70.56.243 | Country: NL | Risk: none | Protocol: Browser

  [SUSPICIOUS] Ryan Guerrero (ryan@valleywideplastering.com):
    2026-03-03T17:47:26Z | IP: 110.78.211.34 | Country: TH | Risk: none | Protocol: Browser
    2026-03-03T13:13:31Z | IP: 103.39.49.102 | Country: ID | Risk: none | Protocol: Browser
    2026-03-03T01:57:54Z | IP: 110.173.181.85 | Country: IN | Risk: none | Protocol: Browser
    2026-03-03T00:02:55Z | IP: 66.116.207.52 | Country: AE | Risk: none | Protocol: Browser
    2026-03-02T18:58:32Z | IP: 8.218.129.104 | Country: SG | Risk: none | Protocol: Browser
  [WARNING] risk check sammy@valleywideplastering.com: This request is throttled. Please try again after the value specified in the Retry-After header. CorrelationId: b25c6b25-5553-4ae7-aa4d-040acb94eb26
  [OK] Sammy Montijo (sammy@valleywideplastering.com): No risky sign-ins detected
  [OK] Shelly Dooley (shelly@valleywideplastering.com): No risky sign-ins detected
  [OK] Spro VWP (spro@valleywideplastering.com): No risky sign-ins detected
  [OK] Computer Guru (sysadmin@valleywideplastering.com): No risky sign-ins detected
  [OK] Teresa Carpio (teresa@valleywideplastering.com): No risky sign-ins detected
  [OK] Ty Fetters (Ty@CASARICA.NET): No risky sign-ins detected

======================================================================
  SAVING RESULTS
======================================================================
  Results saved to: D:/ClaudeTools/temp/vwp_bec_results.json

======================================================================
  INCIDENT REPORT SUMMARY
======================================================================

  Target: j-r@valleywideplastering.com (ID: 0af923d0-48c5-4cc1-8553-c60625802815)
  Investigation Date: 2026-03-05 16:18:22 UTC
  Tenant: Valley Wide Plastering (5c53ae9f-7071-4248-b834-8685b646450f)
  Total Users in Tenant: 33

  KEY FINDINGS:
  =============

  [SUSPICIOUS] 8 emails with suspicious subjects
  [SUSPICIOUS] 53 external recipients in sent mail
  [SUSPICIOUS] 11 other users show suspicious sign-in activity

  RECOMMENDED ACTIONS:
  ====================
  1. Reset JR Guerrero's password immediately
  2. Revoke all active sessions (Entra ID > Users > Revoke sessions)
  3. Enable MFA if not already enabled
  4. Remove any suspicious inbox rules
  5. Disable any unauthorized OAuth app grants
  6. Block legacy authentication via Conditional Access
  7. Review sent items for any phishing emails sent from this account
  8. Notify recipients of any suspicious emails
  9. Check for data exfiltration via OneDrive/SharePoint
  10. Monitor account for next 30 days

  Investigation script: D:/ClaudeTools/temp/vwp_bec_investigation.py
  Raw results: D:/ClaudeTools/temp/vwp_bec_results.json

