ORCA

2.2

Checks/check-ORCA118_2.ps1

                                using module "..\ORCA.psm1"

class ORCA118_2 : ORCACheck

{

    <#

        CONSTRUCTOR with Check Header Data

    #>

    ORCA118_2()

    {

        $this.Control="118-2"

        $this.Area="Transport Rules"

        $this.Name="Domain Whitelisting"

        $this.PassText="Domains are not being whitelisted in an unsafe manner"

        $this.FailRecommendation="Remove whitelisting on domains"

        $this.Importance="Emails coming from whitelisted domains bypass several layers of protection within Exchange Online Protection. If domains are whitelisted, they are open to being spoofed from malicious actors."

        $this.ExpandResults=$True

        $this.CheckType=[CheckType]::ObjectPropertyValue

        $this.ObjectType="Transport Rule"

        $this.ItemName="Condition"

        $this.DataType="Whitelisted Address"

        $this.ChiValue=[ORCACHI]::High

        $this.Links= @{

            "Exchange admin center in Exchange Online"="https://outlook.office365.com/ecp/"

            "Using Exchange Transport Rules (ETRs) to allow specific senders"="https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/create-safe-sender-lists-in-office-365#using-exchange-transport-rules-etrs-to-allow-specific-senders-recommended"

        }

    }

    <#

        RESULTS

    #>

    GetResults($Config)

    {

        $Check = "Transport Rule SCL"

        # Look through Transport Rule for an action SetSCL -1

        ForEach($TransportRule in $Config["TransportRules"]) 

        {

            If($TransportRule.SetSCL -eq "-1") 

            {

                #Rules that apply to the sender domain

                #From Address notmatch is to include if just domain name is value

                If($TransportRule.SenderDomainIs -ne $null -or ($TransportRule.FromAddressContainsWords -ne $null -and $TransportRule.FromAddressContainsWords -notmatch ".+@") -or ($TransportRule.FromAddressMatchesPatterns -ne $null -and $TransportRule.FromAddressMatchesPatterns -notmatch ".+@"))

                {

                    #Look for condition that checks auth results header and its value

                    If(($TransportRule.HeaderContainsMessageHeader -eq 'Authentication-Results' -and $TransportRule.HeaderContainsWords -ne $null) -or ($TransportRule.HeaderMatchesMessageHeader -like '*Authentication-Results*' -and $TransportRule.HeaderMatchesPatterns -ne $null)) 

                    {

                        # OK

                    }

                    #Look for exception that checks auth results header and its value 

                    elseif(($TransportRule.ExceptIfHeaderContainsMessageHeader -eq 'Authentication-Results' -and $TransportRule.ExceptIfHeaderContainsWords -ne $null) -or ($TransportRule.ExceptIfHeaderMatchesMessageHeader -like '*Authentication-Results*' -and $TransportRule.ExceptIfHeaderMatchesPatterns -ne $null)) 

                    {

                        # OK

                    }

                    elseif($TransportRule.SenderIpRanges -ne $null) 

                    {

                        # OK

                    }

                    #Look for condition that checks for any other header and its value

                    else 

                    {

                        ForEach($RuleDomain in $($TransportRule.SenderDomainIs)) 

                        {

                            # Check objects

                            $ConfigObject = [ORCACheckConfig]::new()

                            $ConfigObject.Object=$($TransportRule.Name)

                            $ConfigObject.ConfigItem="From Domain"

                            $ConfigObject.ConfigData=$($RuleDomain)

                            if($TransportRule.State -eq "Disabled")

                            {

                                $ConfigObject.InfoText = "This rule is marked as disabled, while this rule will not apply, it is being flagged incase of accidental enablement."

                                $ConfigObject.SetResult([ORCAConfigLevel]::Informational,"Fail")

                            }

                            else 

                            {

                                $ConfigObject.SetResult([ORCAConfigLevel]::Standard,"Fail")

                            }

                            $this.AddConfig($ConfigObject)  

                        }

                        ForEach($FromAddressContains in $($TransportRule.FromAddressContainsWords)) 

                        {

                            # Check objects

                            $ConfigObject = [ORCACheckConfig]::new()

                            $ConfigObject.Object=$($TransportRule.Name)

                            $ConfigObject.ConfigItem="From Contains"

                            $ConfigObject."$($FromAddressContains)"

                            if($TransportRule.State -eq "Disabled")

                            {

                                $ConfigObject.InfoText = "This rule is marked as disabled, while this rule will not apply, it is being flagged incase of accidental enablement."

                                $ConfigObject.SetResult([ORCAConfigLevel]::Informational,"Fail")

                            }

                            else 

                            {

                                $ConfigObject.SetResult([ORCAConfigLevel]::Standard,"Fail")

                            }

                            $this.AddConfig($ConfigObject)  

                        }

                        ForEach($FromAddressMatch in $($TransportRule.FromAddressMatchesPatterns)) 

                        {

                            # Check objects

                            $ConfigObject = [ORCACheckConfig]::new()

                            $ConfigObject.Object=$($TransportRule.Name)

                            $ConfigObject.ConfigItem="From Matches"

                            $ConfigObject."$($FromAddressMatch)"

                            if($TransportRule.State -eq "Disabled")

                            {

                                $ConfigObject.InfoText = "This rule is marked as disabled, while this rule will not apply, it is being flagged incase of accidental enablement."

                                $ConfigObject.SetResult([ORCAConfigLevel]::Informational,"Fail")

                            }

                            else 

                            {

                                $ConfigObject.SetResult([ORCAConfigLevel]::Standard,"Fail")

                            }

                            $this.AddConfig($ConfigObject) 

                        }

                    }

                }

                #No sender domain restriction, so check for IP restriction

                elseif($null -ne $TransportRule.SenderIpRanges) 

                {

                    ForEach($SenderIpRange in $TransportRule.SenderIpRanges) 

                    {

                        # Check objects

                        $ConfigObject = [ORCACheckConfig]::new()

                        $ConfigObject.Object=$($TransportRule.Name)

                        $ConfigObject.ConfigItem="IP Range"

                        $ConfigObject.ConfigData=$SenderIpRange

                        if($TransportRule.State -eq "Disabled")

                        {

                            $ConfigObject.InfoText = "This rule is marked as disabled, while this rule will not apply, it is being flagged incase of accidental enablement."

                            $ConfigObject.SetResult([ORCAConfigLevel]::Informational,"Fail")

                        }

                        else 

                        {

                            $ConfigObject.SetResult([ORCAConfigLevel]::Standard,"Fail")

                        }

                        $this.AddConfig($ConfigObject) 

                    }

                }

                #No sender restriction, so check for condition that checks auth results header and its value

                elseif(($TransportRule.HeaderContainsMessageHeader -eq 'Authentication-Results' -and $TransportRule.HeaderContainsWords -ne $null) -or ($TransportRule.HeaderMatchesMessageHeader -like '*Authentication-Results*' -and $TransportRule.HeaderMatchesPatterns -ne $null)) 

                {

                    # OK

                }

                #No sender restriction, so check for exception that checks auth results header and its value 

                elseif(($TransportRule.ExceptIfHeaderContainsMessageHeader -eq 'Authentication-Results' -and $TransportRule.ExceptIfHeaderContainsWords -ne $null) -or ($TransportRule.ExceptIfHeaderMatchesMessageHeader -like '*Authentication-Results*' -and $TransportRule.ExceptIfHeaderMatchesPatterns -ne $null)) 

                {

                    # OK

                }

            }

        }    

    }

}

# SIG # Begin signature block

# MIIlvwYJKoZIhvcNAQcCoIIlsDCCJawCAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCoR5dtyTetF6Ww

# oHIOTQi1r5hYaYb631SKQdxUqR6O96CCC6UwggUKMIID8qADAgECAhMzAAAFOerE

# zyAjdtJfAAEAAAU5MA0GCSqGSIb3DQEBCwUAMHkxCzAJBgNVBAYTAlVTMRMwEQYD

# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy

# b3NvZnQgQ29ycG9yYXRpb24xIzAhBgNVBAMTGk1pY3Jvc29mdCBUZXN0aW5nIFBD

# QSAyMDEwMB4XDTIyMDUwNTIwMDgwMFoXDTIzMDUwNDIwMDgwMFowfDELMAkGA1UE

# BhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAc

# BgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdQ29kZSBTaWdu

# IFRlc3QgKERPIE5PVCBUUlVTVCkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK

# AoIBAQCbG5wszQxPSAu4WUO6mrT0Ah7aLQY35Uu8h8eWEeaYgdyqjUlUs2hVwSQd

# 8fAl2IAe++y448He+r+NzsC6vwc2iPWRF2Tjl29EGOp/Kn6Okj15/anyvlQ+7On9

# GMjDTsLDBUD6yCSCZBygPxiktkFH8CnKIZ2xCD2OUUkRoGofo+0t8COCoaiqVQzT

# kQDV5ET45Gliz8etzWN9Ho2AHC4hwQZz0T/zNLUvGivqS/8ns/tsqigDNIxgT9Iy

# Mm4hXjuIvjx7fzQkVyMY6ORRPZ0fJzH+ZyMCmr9QtKs6Tv0Uva4oaNPggLVnVKrJ

# qwcr7oytd5sN7vqADBqtbUOIt0CNAgMBAAGjggGGMIIBgjATBgNVHSUEDDAKBggr

# BgEFBQcDAzAdBgNVHQ4EFgQUx1nHx7dJRksCcK4WcH1JCzbr3TowVAYDVR0RBE0w

# S6RJMEcxLTArBgNVBAsTJE1pY3Jvc29mdCBJcmVsYW5kIE9wZXJhdGlvbnMgTGlt

# aXRlZDEWMBQGA1UEBRMNMjMwMDcyKzQ3MDA0NjAfBgNVHSMEGDAWgBS/ZaKrb3Wj

# TkWWVwXPOYf0wBUcHDBcBgNVHR8EVTBTMFGgT6BNhktodHRwOi8vd3d3Lm1pY3Jv

# c29mdC5jb20vcGtpb3BzL2NybC9NaWNyb3NvZnQlMjBUZXN0aW5nJTIwUENBJTIw

# MjAxMCgxKS5jcmwwaQYIKwYBBQUHAQEEXTBbMFkGCCsGAQUFBzAChk1odHRwOi8v

# d3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01pY3Jvc29mdCUyMFRlc3Rp

# bmclMjBQQ0ElMjAyMDEwKDEpLmNydDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEB

# CwUAA4IBAQC8sVhFQnjzIfS8M/D1b4gViIvun2AjNFcx2seZJj09JzZud5f0nyue

# O3aTdvC1uEdRh2h1SZD1aYTQ40KMQ6EO44bBHof26HywDQW0rKmOOiz57LGqYplJ

# F39VbSohdBCogcqKa0WjEc4XGNha2MO8idELZ3A3glSTZhx2xfhGB0mLFNIwBhya

# snymRDDFyDNaznN1ZpsQ/Lq6We5c7aSH8+20JlcjZXUbRfB+kJ7hpevvPQLUxp/7

# hVM3YDD1Z5sbOkbAZXZKTuk+sn0zgoQwPRTFJUhF0WTACFviMvjBNwlg/+BQRlWH

# kc9wBRU1HSNqcHIdZFmJWNIkUYmyQHYjMIIGkzCCBHugAwIBAgITMwAAAC01ekaI

# yQdx2AAAAAAALTANBgkqhkiG9w0BAQsFADCBkDELMAkGA1UEBhMCVVMxEzARBgNV

# BAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jv

# c29mdCBDb3Jwb3JhdGlvbjE6MDgGA1UEAxMxTWljcm9zb2Z0IFRlc3RpbmcgUm9v

# dCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgMjAxMDAeFw0yMDEyMTAyMDQzMjBaFw0z

# NTA2MTcyMTA0MTFaMHkxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9u

# MRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRp

# b24xIzAhBgNVBAMTGk1pY3Jvc29mdCBUZXN0aW5nIFBDQSAyMDEwMIIBIjANBgkq

# hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvzxggau+7P/XF2PypkLRE2KcsBfOukYa

# eyIuVXOaVLnG1NHKmP53Rw2OnfBezPhU7/LPKtRi8ak0CgTXxQWG8hD1TdOWCGaF

# 2wJ9GNzieiOnmildrnkYzwxj8Br/gampQz+pC7lR8bNIOvxELl8RxVY6/8oOzYgI

# wf3H1fU+7+pOG3KLI71FN54fcMGnybggc+3zbD2LIQXPdxL+odwH6Q1beAlsMlUQ

# R9A3yMf3+nP+RjTkVhaoN2RT1jX7w4C2jraGkaEQ1sFK9uN61BEKst4unhCX4IGu

# El2IAV3MpMQoUpxg8ArmiK9L6VeK7KMPNx4p9l0h09faXQ7JTtuNbQIDAQABo4IB

# +jCCAfYwDgYDVR0PAQH/BAQDAgGGMBIGCSsGAQQBgjcVAQQFAgMBAAEwIwYJKwYB

# BAGCNxUCBBYEFOqfXzO20F+erestpsECu0A4y+e1MB0GA1UdDgQWBBS/ZaKrb3Wj

# TkWWVwXPOYf0wBUcHDBUBgNVHSAETTBLMEkGBFUdIAAwQTA/BggrBgEFBQcCARYz

# aHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9Eb2NzL1JlcG9zaXRvcnku

# aHRtMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMBAf8w

# HwYDVR0jBBgwFoAUowEEfjCIM+u5MZzK64V2Z/xltNEwWQYDVR0fBFIwUDBOoEyg

# SoZIaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMvTWlj

# VGVzUm9vQ2VyQXV0XzIwMTAtMDYtMTcuY3JsMIGNBggrBgEFBQcBAQSBgDB+ME0G

# CCsGAQUFBzAChkFodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL2NlcnRzL01p

# Y1Rlc1Jvb0NlckF1dF8yMDEwLTA2LTE3LmNydDAtBggrBgEFBQcwAYYhaHR0cDov

# L29uZW9jc3AubWljcm9zb2Z0LmNvbS9vY3NwMA0GCSqGSIb3DQEBCwUAA4ICAQAn

# tNCFsp7MD6QqU3PVbdrXMQDI9v9jyPYBEbUYktrctPmvJuj8Snm9wWewiAN5Zc81

# NQVYjuKDBpb1un4SWVCb4PDVPZ0J87tGzYe9dOJ30EYGeiIaaStkLLmLOYAM6oIn

# IqIwVyIk2SE/q2lGt8OvwcZevNmPkVYjk6nyJi5EdvS6ciPRmW9bRWRT4pWU8bZI

# QL938LE4lHOQAixrAQiWes5Szp2U85E0nLdaDr5w/I28J/Z1+4zW1Nao1prVCOqr

# osnoNUfVf1kvswfW3FY2l1PiAYp8sGyO57GaztXdBoEOBcDLedfcPra9+NLdEF36

# NkE0g+9dbokFY7KxhUJ8WpMiCmN4yj9LKFLvQbctGMJJY9EwHFifm2pgaiaafKF1

# Gyz+NruJzEEgpysMo/f9AVBQ/qCdPQQGEWp3QDIaef4ts9QTx+RmDKCBDMTFLgFm

# mhbtUY0JWjLkKn7soz/LIcDUle/p5TiFD4VhfZnAcvYQHXfuslnyp+yuhWzASnAQ

# NnOIO6fc1JFIwkDkcM+k/TspfAajzHooSAwXkrOWrjRDV6wI0YzMVHrEyQ0hZ5Nn

# IXbL3lrTkOPjf3NBu1naSNEaySduStDbFVjV3TXoENEnZiugJKYSwmhzoYHM1ngi

# pN5rNdqJiK5ukp6E8LDzi3l5/7XctJQY3+ZgHDJosjGCGXAwghlsAgEBMIGQMHkx

# CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRt

# b25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xIzAhBgNVBAMTGk1p

# Y3Jvc29mdCBUZXN0aW5nIFBDQSAyMDEwAhMzAAAFOerEzyAjdtJfAAEAAAU5MA0G

# CWCGSAFlAwQCAQUAoIGwMBkGCSqGSIb3DQEJAzEMBgorBgEEAYI3AgEEMBwGCisG

# AQQBgjcCAQsxDjAMBgorBgEEAYI3AgEVMC8GCSqGSIb3DQEJBDEiBCAMtzVywdoL

# PpOieWRO3ZhTsJBXraIGxa33hPoCExbPSDBEBgorBgEEAYI3AgEMMTYwNKAUgBIA

# TQBpAGMAcgBvAHMAbwBmAHShHIAaaHR0cHM6Ly93d3cubWljcm9zb2Z0LmNvbSAw

# DQYJKoZIhvcNAQEBBQAEggEARg1J8F8i/JB0mAY5yx9F7wCyNd7QXdoeDirNM1jU

# HbZjZndwNgvRwuS51B4AQhMxMcpvQSSLhpH8F81TG0MZh1ksOtb95WyIGF365D0M

# 5k7bilFv7JYYZqOlryAWRpRYQ4anUAsMZoemQxE5cRaiwBnu6YT5PhVXLBp+PgNy

# bBFFVKfr9906ccCHH+v8cWm8gmLNuEKTO338rI+Xf3qiJT9GliY6Dw5Nue1HTZJV

# NE/MFW08M0H27i5K9Co46t2LOZuhjF0qiwFDoDrRjXklrfXQcuRgxZDbwa33YAEm

# ofZvdLYpErh9mejUQYGU4h7xcZNxRTRTGziZVIUwawRKwKGCFv0wghb5BgorBgEE

# AYI3AwMBMYIW6TCCFuUGCSqGSIb3DQEHAqCCFtYwghbSAgEDMQ8wDQYJYIZIAWUD

# BAIBBQAwggFRBgsqhkiG9w0BCRABBKCCAUAEggE8MIIBOAIBAQYKKwYBBAGEWQoD

# ATAxMA0GCWCGSAFlAwQCAQUABCD678XcCfLH4EM+wlYxsr4sfvZKxKjd3e5tuBnp

# YozOsgIGY+4WVm4oGBMyMDIzMDMwMjA1NDU0Ni4wNjVaMASAAgH0oIHQpIHNMIHK

# MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVk

# bW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxN

# aWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25zMSYwJAYDVQQLEx1UaGFsZXMgVFNT

# IEVTTjpERDhDLUUzMzctMkZBRTElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3Rh

# bXAgU2VydmljZaCCEVQwggcMMIIE9KADAgECAhMzAAABxQPNzSGh9O85AAEAAAHF

# MA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5n

# dG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9y

# YXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwMB4X

# DTIyMTEwNDE5MDEzMloXDTI0MDIwMjE5MDEzMlowgcoxCzAJBgNVBAYTAlVTMRMw

# EQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVN

# aWNyb3NvZnQgQ29ycG9yYXRpb24xJTAjBgNVBAsTHE1pY3Jvc29mdCBBbWVyaWNh

# IE9wZXJhdGlvbnMxJjAkBgNVBAsTHVRoYWxlcyBUU1MgRVNOOkREOEMtRTMzNy0y

# RkFFMSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNlMIICIjAN

# BgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAq0hds70eX23J7pappaKXRhz+TT7J

# J3OvVf3+N8fNpxRs5jY4hEv3BV/w5EWXbZdO4m3xj01lTI/xDkq+ytjuiPe8xGXs

# ZxDntv7L1EzMd5jISqJ+eYu8kgV056mqs8dBo55xZPPPcxf5u19zn04aMQF5PXV/

# C4ZLSjFa9IFNcribdOm3lGW1rQRFa2jUsup6gv634q5UwH09WGGu0z89RbtbyM55

# vmBgWV8ed6bZCZrcoYIjML8FRTvGlznqm6HtwZdXMwKHT3a/kLUSPiGAsrIgEzz7

# NpBpeOsgs9TrwyWTZBNbBwyIACmQ34j+uR4et2hZk+NH49KhEJyYD2+dOIaDGB2E

# UNFSYcy1MkgtZt1eRqBB0m+YPYz7HjocPykKYNQZ7Tv+zglOffCiax1jOb0u6IYC

# 5X1Jr8AwTcsaDyu3qAhx8cFQN9DDgiVZw+URFZ8oyoDk6sIV1nx5zZLy+hNtakeP

# X9S7Y8n1qWfAjoXPE6K0/dbTw87EOJL/BlJGcKoFTytr0zPg/MNJSb6f2a/wDkXo

# GCGWJiQrGTxjOP+R96/nIIG05eE1Lpky2FOdYMPB4DhW7tBdZautepTTuShmgn+G

# KER8AoA1gSSk1EC5ZX4cppVngJpblMBu8r/tChfHVdXviY6hDShHwQCmZqZebgSY

# HnHl4urE+4K6ZC8CAwEAAaOCATYwggEyMB0GA1UdDgQWBBRU6rs4v1mxNYG/rtpL

# wrVwek0FazAfBgNVHSMEGDAWgBSfpxVdAF5iXYP05dJlpxtTNRnpcjBfBgNVHR8E

# WDBWMFSgUqBQhk5odHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9N

# aWNyb3NvZnQlMjBUaW1lLVN0YW1wJTIwUENBJTIwMjAxMCgxKS5jcmwwbAYIKwYB

# BQUHAQEEYDBeMFwGCCsGAQUFBzAChlBodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20v

# cGtpb3BzL2NlcnRzL01pY3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAyMDEw

# KDEpLmNydDAMBgNVHRMBAf8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMIMA0GCSqG

# SIb3DQEBCwUAA4ICAQCMqN58frMHOScciK+Cdnr6dK8fTsgQDeZ9bvQjCuxNIJZJ

# 92+xpeKRCf3Xq47qdRykkKUnZC6dHhLwt1fhwyiy/LfdVQ9yf1hYZ/RpTS+z0hna

# oK+P/IDAiUNm32NXLhDBu0P4Sb/uCV4jOuNUcmJhppBQgQVhFx/57JYk1LCdjIee

# //GrcfbkQtiYob9Oa93DSjbsD1jqaicEnkclUN/mEm9ZsnCnA1+/OQDp/8Q4cPfH

# 94LM4J6X0NtNBeVywvWH0wuMaOJzHgDLCeJUkFE9HE8sBDVedmj6zPJAI+7ozLjY

# qw7i4RFbiStfWZSGjwt+lLJQZRWUCcT3aHYvTo1YWDZskohWg77w9fF2QbiO9Dfn

# qoZ7QozHi7RiPpbjgkJMAhrhpeTf/at2e9+HYkKObUmgPArH1Wjivwm1d7PYWsar

# L7u5qZuk36Gb1mETS1oA2XX3+C3rgtzRohP89qZVf79lVvjmg34NtICK/pMk99SB

# utghtipFSMQdbXUnS2oeLt9cKuv1MJu+gJ83qXTNkQ2QqhxtNRvbE9QqmqJQw5VW

# /4SZze1pPXxyOTO5yDq+iRIUubqeQzmUcCkiyNuCLHWh8OLCI5mIOC1iLtVDf2lw

# 9eWropwu5SDJtT/ZwqIU1qb2U+NjkNcj1hbODBRELaTTWd91RJiUI9ncJkGg/jCC

# B3EwggVZoAMCAQICEzMAAAAVxedrngKbSZkAAAAAABUwDQYJKoZIhvcNAQELBQAw

# gYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdS

# ZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMT

# KU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDEwMB4XDTIx

# MDkzMDE4MjIyNVoXDTMwMDkzMDE4MzIyNVowfDELMAkGA1UEBhMCVVMxEzARBgNV

# BAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jv

# c29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAg

# UENBIDIwMTAwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDk4aZM57Ry

# IQt5osvXJHm9DtWC0/3unAcH0qlsTnXIyjVX9gF/bErg4r25PhdgM/9cT8dm95VT

# cVrifkpa/rg2Z4VGIwy1jRPPdzLAEBjoYH1qUoNEt6aORmsHFPPFdvWGUNzBRMhx

# XFExN6AKOG6N7dcP2CZTfDlhAnrEqv1yaa8dq6z2Nr41JmTamDu6GnszrYBbfowQ

# HJ1S/rboYiXcag/PXfT+jlPP1uyFVk3v3byNpOORj7I5LFGc6XBpDco2LXCOMcg1

# KL3jtIckw+DJj361VI/c+gVVmG1oO5pGve2krnopN6zL64NF50ZuyjLVwIYwXE8s

# 4mKyzbnijYjklqwBSru+cakXW2dg3viSkR4dPf0gz3N9QZpGdc3EXzTdEonW/aUg

# fX782Z5F37ZyL9t9X4C626p+Nuw2TPYrbqgSUei/BQOj0XOmTTd0lBw0gg/wEPK3

# Rxjtp+iZfD9M269ewvPV2HM9Q07BMzlMjgK8QmguEOqEUUbi0b1qGFphAXPKZ6Je

# 1yh2AuIzGHLXpyDwwvoSCtdjbwzJNmSLW6CmgyFdXzB0kZSU2LlQ+QuJYfM2BjUY

# hEfb3BvR/bLUHMVr9lxSUV0S2yW6r1AFemzFER1y7435UsSFF5PAPBXbGjfHCBUY

# P3irRbb1Hode2o+eFnJpxq57t7c+auIurQIDAQABo4IB3TCCAdkwEgYJKwYBBAGC

# NxUBBAUCAwEAATAjBgkrBgEEAYI3FQIEFgQUKqdS/mTEmr6CkTxGNSnPEP8vBO4w

# HQYDVR0OBBYEFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMFwGA1UdIARVMFMwUQYMKwYB

# BAGCN0yDfQEBMEEwPwYIKwYBBQUHAgEWM2h0dHA6Ly93d3cubWljcm9zb2Z0LmNv

# bS9wa2lvcHMvRG9jcy9SZXBvc2l0b3J5Lmh0bTATBgNVHSUEDDAKBggrBgEFBQcD

# CDAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYDVR0T

# AQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTV9lbLj+iiXGJo0T2UkFvXzpoYxDBWBgNV

# HR8ETzBNMEugSaBHhkVodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2NybC9w

# cm9kdWN0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcmwwWgYIKwYBBQUHAQEE

# TjBMMEoGCCsGAQUFBzAChj5odHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL2Nl

# cnRzL01pY1Jvb0NlckF1dF8yMDEwLTA2LTIzLmNydDANBgkqhkiG9w0BAQsFAAOC

# AgEAnVV9/Cqt4SwfZwExJFvhnnJL/Klv6lwUtj5OR2R4sQaTlz0xM7U518JxNj/a

# ZGx80HU5bbsPMeTCj/ts0aGUGCLu6WZnOlNN3Zi6th542DYunKmCVgADsAW+iehp

# 4LoJ7nvfam++Kctu2D9IdQHZGN5tggz1bSNU5HhTdSRXud2f8449xvNo32X2pFaq

# 95W2KFUn0CS9QKC/GbYSEhFdPSfgQJY4rPf5KYnDvBewVIVCs/wMnosZiefwC2qB

# woEZQhlSdYo2wh3DYXMuLGt7bj8sCXgU6ZGyqVvfSaN0DLzskYDSPeZKPmY7T7uG

# +jIa2Zb0j/aRAfbOxnT99kxybxCrdTDFNLB62FD+CljdQDzHVG2dY3RILLFORy3B

# FARxv2T5JL5zbcqOCb2zAVdJVGTZc9d/HltEAY5aGZFrDZ+kKNxnGSgkujhLmm77

# IVRrakURR6nxt67I6IleT53S0Ex2tVdUCbFpAUR+fKFhbHP+CrvsQWY9af3LwUFJ

# fn6Tvsv4O+S3Fb+0zj6lMVGEvL8CwYKiexcdFYmNcP7ntdAoGokLjzbaukz5m/8K

# 6TT4JDVnK+ANuOaMmdbhIurwJ0I9JZTmdHRbatGePu1+oDEzfbzL6Xu/OHBE0ZDx

# yKs6ijoIYn/ZcGNTTY3ugm2lBRDBcQZqELQdVTNYs6FwZvKhggLLMIICNAIBATCB

# +KGB0KSBzTCByjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAO

# BgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEl

# MCMGA1UECxMcTWljcm9zb2Z0IEFtZXJpY2EgT3BlcmF0aW9uczEmMCQGA1UECxMd

# VGhhbGVzIFRTUyBFU046REQ4Qy1FMzM3LTJGQUUxJTAjBgNVBAMTHE1pY3Jvc29m

# dCBUaW1lLVN0YW1wIFNlcnZpY2WiIwoBATAHBgUrDgMCGgMVACEAGvYXZJK7cUo6

# 2+LvEYQEx7/noIGDMIGApH4wfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hp

# bmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jw

# b3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAw

# DQYJKoZIhvcNAQEFBQACBQDnql+wMCIYDzIwMjMwMzAyMDczNTEyWhgPMjAyMzAz

# MDMwNzM1MTJaMHQwOgYKKwYBBAGEWQoEATEsMCowCgIFAOeqX7ACAQAwBwIBAAIC

# FZYwBwIBAAICEdIwCgIFAOersTACAQAwNgYKKwYBBAGEWQoEAjEoMCYwDAYKKwYB

# BAGEWQoDAqAKMAgCAQACAwehIKEKMAgCAQACAwGGoDANBgkqhkiG9w0BAQUFAAOB

# gQCk+oXro/yphled0rnkbEjojBgyhvFJI11QeB7D/Ih9f1OXFuyD6+eEHggRMzqU

# IcaU7V+WR13a0uGrdNxm/DhdcHb9v9v4QeVKISEx4XS9qR5vrNhGlGn3zjxxfFTy

# dumeqeOwzHJtIji6hLIuqPetk//Tk1uyKZrypxJ4x+KZgDGCBA0wggQJAgEBMIGT

# MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdS

# ZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMT

# HU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwAhMzAAABxQPNzSGh9O85AAEA

# AAHFMA0GCWCGSAFlAwQCAQUAoIIBSjAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQ

# AQQwLwYJKoZIhvcNAQkEMSIEIJxiP0Z4Dz6WYP1/q7bPBuaQvWDyxPVXh2IMhK/d

# 2cczMIH6BgsqhkiG9w0BCRACLzGB6jCB5zCB5DCBvQQgGQGxkfYkd0wK+V09wO0s

# O+sm8gAMyj5EuKPqvNQ/fLEwgZgwgYCkfjB8MQswCQYDVQQGEwJVUzETMBEGA1UE

# CBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9z

# b2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQ

# Q0EgMjAxMAITMwAAAcUDzc0hofTvOQABAAABxTAiBCDDuEjZ9Sqg2OPcM+OjCIe5

# A7VnZ6gDUjviVU7bJ3W/OjANBgkqhkiG9w0BAQsFAASCAgBb6SAMPCclK0HYNZyM

# fu+Ra6Z7rrYAkOXk5tjDCOc6/zORQlrldL3M9xerjn91k4gNYPbXeH+3WBPb3qUC

# 3B0sbowWb6DzT3guzkV5mbbeE17tiPXf/Hejoc360adRe7YsCXhWRwcovq8ecDTg

# X3AyLy3BqHBcva/ojHCfv+5prqUY42TY53LtJ5JCOy20LWVm1VsY/maX5AxDyayH

# Wc3h69FX+XKhuQBYzBEuQnh4fSnfNvSpV7xptUePsUDo5kGwu8QD0gAPcWKAdaUd

# XdkRH/3wLAa56NMfJJUDcJZFW18RjvfSO5rYOsB/FhsgzwiaGw/IkznFjb5WK8dU

# t5+Yp7+FwR1Er7m4IhmpUr8EZOcTVJypjp6g6ajuD6h5PybSEW4PPRtp0JMGI7OK

# w3lgYdEJJdRQ9ugtLMDbPPBdPeyWJXPJNAWgdyn6n5itfjJc8ETvboYk0BB5wdl0

# JgSdMaQ/GfK6rhpSccg5fZxCplML5tCJlLF5EgEiw4gzDN+Mkfp9yN+RBopvrw8M

# gxDn6MREoTE3H1ZfwaULOVBj0Dy+IiXFc3kszfHoCbFen4k60BnYv+OnMGzxx+O+

# vmI9WnCt6f8+U6STCU1edoqdwTzlLKC0eFJWYazm1OKfyaTMynV6/hY2KZfT/vep

# 2xF3a13m8M28SNIZDGsgn5QwMQ==

# SIG # End signature block