ORCAPreview

2.4

ORCA.psm1

#Requires -Version 5.1

<#
    .SYNOPSIS
        The Office 365 Recommended Configuration Analyzer (ORCA)
 
    .DESCRIPTION
        
 
    .NOTES
        Cam Murray
        Senior Program Manager - Microsoft
        camurray@microsoft.com
         
        Daniel Mozes
        Senior Program Manager - Microsoft
        damozes@microsoft.com
 
        Output report uses open source components for HTML formatting
        - bootstrap - MIT License - https://getbootstrap.com/docs/4.0/about/license/
        - fontawesome - CC BY 4.0 License - https://fontawesome.com/license/free
         
        ############################################################################
 
        This sample script is not supported under any Microsoft standard support program or service.
        This sample script is provided AS IS without warranty of any kind.
        Microsoft further disclaims all implied warranties including, without limitation, any implied
        warranties of merchantability or of fitness for a particular purpose. The entire risk arising
        out of the use or performance of the sample script and documentation remains with you. In no
        event shall Microsoft, its authors, or anyone else involved in the creation, production, or
        delivery of the scripts be liable for any damages whatsoever (including, without limitation,
        damages for loss of business profits, business interruption, loss of business information,
        or other pecuniary loss) arising out of the use of or inability to use the sample script or
        documentation, even if Microsoft has been advised of the possibility of such damages.
 
        ############################################################################
 
    .LINK
        about_functions_advanced
 
#>
[System.Collections.ArrayList] $global:SafeLinkPolicyStatus = [System.Collections.ArrayList] @()
[System.Collections.ArrayList] $global:SafeAttachmentsPolicyStatus = [System.Collections.ArrayList] @()
[System.Collections.ArrayList] $global:MalwarePolicyStatus = [System.Collections.ArrayList] @()
[System.Collections.ArrayList] $global:AntiSpamPolicyStatus = [System.Collections.ArrayList] @()
[System.Collections.ArrayList] $global:HostedContentPolicyStatus = [System.Collections.ArrayList] @()


function Get-ORCADirectory
{
    <#
 
        Gets or creates the ORCA directory in AppData
         
    #>

    If($IsWindows)
    {
        $Directory = "$($env:LOCALAPPDATA)\Microsoft\ORCA"
    }
    elseif($IsLinux -or $IsMacOS)
    {
        $Directory = "$($env:HOME)/ORCA"
    }
    else 
    {
        $Directory = "$($env:LOCALAPPDATA)\Microsoft\ORCA"
    }

    If(Test-Path $Directory) 
    {
        Return $Directory
    } 
    else 
    {
        New-Item -Type Directory $Directory | out-null
        Return $Directory
    }

}

Function Invoke-ORCAConnections
{
    Param
    (
        [String]$ExchangeEnvironmentName,
        [String]$DelegatedOrganization,
        [Boolean]$Install
    )
    <#
     
    Check which module is loaded and then run the respective connection
     
    #>

    If(Get-Command "Connect-ExchangeOnline" -ErrorAction:SilentlyContinue)
    {
        Write-Host "$(Get-Date) Connecting to Exchange Online (Modern Module).."

        if($DelegatedOrganization -eq $null)
        {
            Connect-ExchangeOnline -ExchangeEnvironmentName $ExchangeEnvironmentName -WarningAction:SilentlyContinue | Out-Null
        } else 
        {
            Connect-ExchangeOnline -ExchangeEnvironmentName $ExchangeEnvironmentName -WarningAction:SilentlyContinue -DelegatedOrganization $DelegatedOrganization | Out-Null
        }
        
    }
    ElseIf(Get-Command "Connect-EXOPSSession" -ErrorAction:SilentlyContinue)
    {

        # Cannot use Delegated Organization connecting this way, potentially we should deprecate this way of connecting
        if($DelegatedOrganization -ne $null)
        {
            throw "Cannot use DelegatedOrganization without Exchange Online PowerShell module installed."
        }

        Write-Host "$(Get-Date) Connecting to Exchange Online.."
        Connect-EXOPSSession -PSSessionOption $ProxySetting -WarningAction:SilentlyContinue | Out-Null    
    } 
    Else 
    {
        If($Install)
        {
            Try
            {
                # Try installing ExchangeOnlineManagement module in to CurrentUser scope
                Write-Host "$(Get-Date) Exchange Online Management module is missing - attempting to install in to CurrentUser scope.. (You may be asked to trust the PS Gallery)"
                Install-Module ExchangeOnlineManagement -ErrorAction:SilentlyContinue -Scope CurrentUser

                # Then connect..
                Connect-ExchangeOnline -ExchangeEnvironmentName $ExchangeEnvironmentName -WarningAction:SilentlyContinue  | Out-Null

                $Installed = $True
            }
            catch
            {
                $Installed = $False
            }
        }

        if(!$Installed)
        {
            # Error if not installed
            Throw "ORCA requires either the Exchange Online PowerShell Module (aka.ms/exopsmodule) loaded or the Exchange Online PowerShell module from the PowerShell Gallery installed."
        }
    }

    # Perform check for Exchange Connection Status
    If($(Get-EXConnectionStatus) -eq $False)
    {
        Throw "ORCA was unable to connect to Exchange Online, or you do not have sufficient permissions to check ORCA related configuration."
    }
}

enum CheckType
{
    ObjectPropertyValue
    PropertyValue
}

[Flags()]
enum ORCAService
{
    EOP = 1
    OATP = 2
}

enum ORCAConfigLevel
{
    None = 0
    Informational = 4
    Standard = 5
    Strict = 10
    TooStrict = 15
}

enum ORCAResult
{
    Pass = 1
    Informational = 2
    Fail = 3
}

enum ORCACHI
{
    NotRated = 0
    Low = 5
    Medium = 10
    High = 15
    VeryHigh = 20
    Critical = 100
}

enum PolicyType
{
    Malware
    Spam
    Antiphish
    SafeAttachments
    SafeLinks
    OutboundSpam
}

enum PresetPolicyLevel
{
    None = 0
    Strict = 1
    Standard = 2
}

Class ORCACheckConfig
{

    ORCACheckConfig()
    {
        # Constructor

        $this.Results = @()

        $this.Results += New-Object -TypeName ORCACheckConfigResult -Property @{
            Level=[ORCAConfigLevel]::Informational
        }

        $this.Results += New-Object -TypeName ORCACheckConfigResult -Property @{
            Level=[ORCAConfigLevel]::Standard
        }

        $this.Results += New-Object -TypeName ORCACheckConfigResult -Property @{
            Level=[ORCAConfigLevel]::Strict
        }

        $this.Results += New-Object -TypeName ORCACheckConfigResult -Property @{
            Level=[ORCAConfigLevel]::TooStrict
        }
    }

    # Set the result for this mode
    SetResult([ORCAConfigLevel]$Level,$Result)
    {
        ($this.Results | Where-Object {$_.Level -eq $Level}).Value = $Result

        # The level of this configuration should be its strongest result (e.g if its currently standard and we have a strict pass, we should make the level strict)
        if($Result -eq "Pass" -and ($this.Level -lt $Level -or $this.Level -eq [ORCAConfigLevel]::None))
        {
            $this.Level = $Level
        } 
        elseif ($Result -eq "Fail" -and ($Level -eq [ORCAConfigLevel]::Informational -and $this.Level -eq [ORCAConfigLevel]::None))
        {
            $this.Level = $Level
        }

    }

    $Check
    $Object
    $ConfigItem
    $ConfigData
    $ConfigReadonly
    $ConfigDisabled
    [string]$ConfigPolicyGuid
    $InfoText
    [array]$Results
    [ORCAConfigLevel]$Level
}

Class ORCACheckConfigResult
{
    [ORCAConfigLevel]$Level=[ORCAConfigLevel]::Standard
    $Value
}

Class ORCACheck
{
    <#
 
        Check definition
 
        The checks defined below allow contextual information to be added in to the report HTML document.
        - Control : A unique identifier that can be used to index the results back to the check
        - Area : The area that this check should appear within the report
        - PassText : The text that should appear in the report when this 'control' passes
        - FailRecommendation : The text that appears as a title when the 'control' fails. Short, descriptive. E.g "Do this"
        - Importance : Why this is important
        - ExpandResults : If we should create a table in the callout which points out which items fail and where
        - ObjectType : When ExpandResults is set to, For Object, Property Value checks - what is the name of the Object, e.g a Spam Policy
        - ItemName : When ExpandResults is set to, what does the check return as ConfigItem, for instance, is it a Transport Rule?
        - DataType : When ExpandResults is set to, what type of data is returned in ConfigData, for instance, is it a Domain?
 
    #>

    [Array] $Config=@()
    [string] $Control
    [String] $Area
    [String] $Name
    [String] $PassText
    [String] $FailRecommendation
    [Boolean] $ExpandResults=$false
    [String] $ObjectType
    [String] $ItemName
    [String] $DataType
    [String] $Importance
    [ORCACHI] $ChiValue = [ORCACHI]::NotRated
    [ORCAService]$Services = [ORCAService]::EOP
    [CheckType] $CheckType = [CheckType]::PropertyValue
    $Links
    $ORCAParams
    [Boolean] $SkipInReport=$false

    [ORCAResult] $Result=[ORCAResult]::Pass
    [int] $FailCount=0
    [int] $PassCount=0
    [int] $InfoCount=0
    [Boolean] $Completed=$false

    [Boolean] $CheckFailed = $false
    [String] $CheckFailureReason = $null
    
    # Overridden by check
    GetResults($Config) { }

    AddConfig([ORCACheckConfig]$Config)
    {

        # Manipulate result for disabled

        if($Config.ConfigDisabled -eq $True)
        {
            $Config.InfoText = "The policy is not enabled and will not apply. The configuration for this policy is not set properly according to this check. It is being flagged incase of accidental enablement."

            ForEach($c in $Config.Results)
            {
                # Downgrade Fails to Informational
                if($c.Level -ne [ORCAConfigLevel]::Pass)
                {
                    $c.Level = [ORCAConfigLevel]::Informational
                }
            }
        }
        
        $this.Config += $Config

        $this.FailCount = @($this.Config | Where-Object {$_.Level -eq [ORCAConfigLevel]::None}).Count
        $this.PassCount = @($this.Config | Where-Object {$_.Level -eq [ORCAConfigLevel]::Standard -or $_.Level -eq [ORCAConfigLevel]::Strict}).Count
        $this.InfoCount = @($this.Config | Where-Object {$_.Level -eq [ORCAConfigLevel]::Informational}).Count

        $InfoCountDefault =  @($this.Config | Where-Object {$_.InfoText -imatch "This is a Built-In/Default policy managed by Microsoft"}).Count
        $InfoCountDisabled =  @($this.Config | Where-Object {$_.InfoText -imatch "The policy is not enabled and will not apply"}).Count

        If($this.FailCount -eq 0 -and $this.InfoCount -eq 0)
        {
            $this.Result = [ORCAResult]::Pass
        }
        elseif($this.FailCount -eq 0 -and $this.InfoCount -gt 0)
        {
            if(($this.InfoCount -eq ($InfoCountDefault + $InfoCountDisabled)) -and ($this.PassCount -gt 0))
            {
                $this.Result = [ORCAResult]::Pass
            }
            else
            {$this.Result = [ORCAResult]::Informational}
        }
        else 
        {
            $this.Result = [ORCAResult]::Fail    
        }

    }

    # Run
    Run($Config)
    {
        Write-Host "$(Get-Date) Analysis - $($this.Area) - $($this.Name)"
        
        $this.GetResults($Config)

        If($this.SkipInReport -eq $True)
        {
            Write-Host "$(Get-Date) Skipping - $($this.Name) - No longer part of $($this.Area)"
            continue
        }

        # If there is no results to expand, turn off ExpandResults
        if($this.Config.Count -eq 0)
        {
            $this.ExpandResults = $false
        }

        # Set check module to completed
        $this.Completed=$true
    }

}

Class ORCAOutput
{

    [String]    $Name
    [Boolean]   $ShowSurvey             =   $true
    [Boolean]   $Completed              =   $False
                $VersionCheck           =   $null
                $DefaultOutputDirectory
                $Result

    # Function overridden
    RunOutput($Checks,$Collection)
    {

    }

    Run($Checks,$Collection)
    {
        Write-Host "$(Get-Date) Output - $($this.Name)"

        $this.RunOutput($Checks,$Collection)

        $this.Completed=$True
    }

}

Function Get-ORCACheckDefs
{
    Param
    (
        $ORCAParams
    )

    $Checks = @()

    # Load individual check definitions
    $CheckFiles = Get-ChildItem "$PSScriptRoot\Checks"

    ForEach($CheckFile in $CheckFiles)
    {
        if($CheckFile.BaseName -match '^check-(.*)$')
        {
            Write-Verbose "Importing $($matches[1])"
            . $CheckFile.FullName
            $Check = New-Object -TypeName $matches[1]

            # Set the ORCAParams
            $Check.ORCAParams = $ORCAParams

            $Checks += $Check
        }
    }

    Return $Checks
}

Function Get-ORCAOutputs
{
    Param
    (
        $VersionCheck,
        $Modules,
        $Options,
        $ShowSurvey
    )

    $Outputs = @()

    # Load individual check definitions
    $OutputFiles = Get-ChildItem "$PSScriptRoot\Outputs"

    ForEach($OutputFile in $OutputFiles)
    {
        if($OutputFile.BaseName -match '^output-(.*)$')
        {
            # Determine if this type should be loaded
            If($Modules -contains $matches[1])
            {
                Write-Verbose "Importing $($matches[1])"
                . $OutputFile.FullName
                $Output = New-Object -TypeName $matches[1]

                # Load any of the options in to the module
                If($Options)
                {

                If($Options[$matches[1]].Keys)
                {
                    ForEach($Opt in $Options[$matches[1]].Keys)
                    {
                        # Ensure this property exists before we try set it and get a null ref error
                        $ModProperties = $($Output | Get-Member | Where-Object {$_.MemberType -eq "Property"}).Name
    
                        If($ModProperties -contains $Opt)
                        {
                            $Output.$Opt = $Options[$matches[1]][$Opt]
                        }
                        else
                        {
                            Throw("There is no option $($Opt) on output module $($matches[1])")
                        }
                    }
                }
            }

                # For default output directory
                $Output.DefaultOutputDirectory = Get-ORCADirectory

                # Provide versioncheck
                $Output.VersionCheck = $VersionCheck
                $Output.ShowSurvey = $ShowSurvey
                
                $Outputs += $Output
            }

        }
    }

    Return $Outputs
}
Class PolicyStats
{
    [String]    $PolicyName
    [Boolean]   $IsEnabled    
}

Function Get-ORCACollection
{
    $Collection = @{}

    [ORCAService]$Collection["Services"] = [ORCAService]::EOP

    # Determine if ATP is available by checking for presence of an ATP command
    if($(Get-command Get-AtpPolicyForO365 -ErrorAction:SilentlyContinue))
    {
        $Collection["Services"] += [ORCAService]::OATP
    } 

    If(!$Collection["Services"] -band [ORCAService]::OATP)
    {
        Write-Host "$(Get-Date) Microsoft Defender for Office 365 is not detected - these checks will be skipped!" -ForegroundColor Red
    }

    Write-Host "$(Get-Date) Getting Anti-Spam Settings"
    $Collection["HostedConnectionFilterPolicy"] = Get-HostedConnectionFilterPolicy
    $Collection["HostedContentFilterPolicy"] = Get-HostedContentFilterPolicy
    $Collection["HostedContentFilterRule"] = Get-HostedContentFilterRule
    $Collection["HostedOutboundSpamFilterPolicy"] = Get-HostedOutboundSpamFilterPolicy
    $Collection["HostedOutboundSpamFilterRule"] = Get-HostedOutboundSpamFilterRule

    Write-Host "$(Get-Date) Getting Tenant Settings"
    $Collection["AdminAuditLogConfig"] = Get-AdminAuditLogConfig

    If($Collection["Services"] -band [ORCAService]::OATP)
    {
        Write-Host "$(Get-Date) Getting ATP Preset Policy Settings"
        $Collection["ATPProtectionPolicyRule"] = Get-ATPProtectionPolicyRule
        $Collection["ATPBuiltInProtectionRule"] = Get-ATPBuiltInProtectionRule
    }

    Write-Host "$(Get-Date) Getting EOP Preset Policy Settings"
    $Collection["EOPProtectionPolicyRule"] = Get-EOPProtectionPolicyRule

    Write-Host "$(Get-Date) Getting Quarantine Policy Settings"
    $Collection["QuarantineTag"] =  Get-QuarantinePolicy
    $Collection["QuarantineTagGlobal"]  = Get-QuarantinePolicy -QuarantinePolicyType GlobalQuarantinePolicy

    If($Collection["Services"] -band [ORCAService]::OATP)
    {
        Write-Host "$(Get-Date) Getting Anti Phish Settings"
        $Collection["AntiPhishPolicy"] = Get-AntiphishPolicy
        $Collection["AntiPhishRules"] = Get-AntiPhishRule
    }

    Write-Host "$(Get-Date) Getting Anti-Malware Settings"
    $Collection["MalwareFilterPolicy"] = Get-MalwareFilterPolicy
    $Collection["MalwareFilterRule"] = Get-MalwareFilterRule

    Write-Host "$(Get-Date) Getting Transport Rules"
    $Collection["TransportRules"] = Get-TransportRule

    If($Collection["Services"] -band [ORCAService]::OATP)
    {
        Write-Host "$(Get-Date) Getting ATP Policies"
        $Collection["SafeAttachmentsPolicy"] = Get-SafeAttachmentPolicy
        $Collection["SafeAttachmentsRules"] = Get-SafeAttachmentRule
        $Collection["SafeLinksPolicy"] = Get-SafeLinksPolicy
        $Collection["SafeLinksRules"] = Get-SafeLinksRule
        $Collection["AtpPolicy"] = Get-AtpPolicyForO365
    }

    Write-Host "$(Get-Date) Getting Accepted Domains"
    $Collection["AcceptedDomains"] = Get-AcceptedDomain

    Write-Host "$(Get-Date) Getting DKIM Configuration"
    $Collection["DkimSigningConfig"] = Get-DkimSigningConfig

    Write-Host "$(Get-Date) Getting Connectors"
    $Collection["InboundConnector"] = Get-InboundConnector

    Write-Host "$(Get-Date) Getting Outlook External Settings"
    $Collection["ExternalInOutlook"] = Get-ExternalInOutlook

    # Required for Enhanced Filtering checks
    Write-Host "$(Get-Date) Getting MX Reports for all domains"
    $Collection["MXReports"] = @()
    ForEach($d in $Collection["AcceptedDomains"])
    {
        Try
        {
            $Collection["MXReports"] += Get-MxRecordReport -Domain $($d.DomainName) -ErrorAction:SilentlyContinue
        }
        Catch
        {
            Write-Verbose "$(Get-Date) Failed to get MX report for domain $($d.DomainName)"
        }
        
    }

    # Determine policy states
    Write-Host "$(Get-Date) Determining applied policy states"

    $Collection["PolicyStates"] = Get-PolicyStates -AntiphishPolicies $Collection["AntiPhishPolicy"] -AntiphishRules $Collection["AntiPhishRules"] -AntimalwarePolicies $Collection["MalwareFilterPolicy"] -AntimalwareRules $Collection["MalwareFilterRule"] -AntispamPolicies $Collection["HostedContentFilterPolicy"] -AntispamRules $Collection["HostedContentFilterRule"] -SafeLinksPolicies $Collection["SafeLinksPolicy"] -SafeLinksRules $Collection["SafeLinksRules"] -SafeAttachmentsPolicies $Collection["SafeAttachmentsPolicy"] -SafeAttachmentRules $Collection["SafeAttachmentsRules"] -ProtectionPolicyRulesATP $Collection["ATPProtectionPolicyRule"] -ProtectionPolicyRulesEOP $Collection["EOPProtectionPolicyRule"] -OutboundSpamPolicies $Collection["HostedOutboundSpamFilterPolicy"] -OutboundSpamRules $Collection["HostedOutboundSpamFilterRule"] -BuiltInProtectionRule $Collection["ATPBuiltInProtectionRule"]
    $Collection["AnyPolicyState"] = Get-AnyPolicyState -PolicyStates $Collection["PolicyStates"]

    # Add IsPreset properties for Preset policies (where applicable)
    Add-IsPresetValue -CollectionEntity $Collection["HostedContentFilterPolicy"]
    Add-IsPresetValue -CollectionEntity $Collection["EOPProtectionPolicyRule"]

    If($Collection["Services"] -band [ORCAService]::OATP)
    {
        Add-IsPresetValue -CollectionEntity $Collection["ATPProtectionPolicyRule"]
        Add-IsPresetValue -CollectionEntity $Collection["AntiPhishPolicy"]
        Add-IsPresetValue -CollectionEntity $Collection["SafeAttachmentsPolicy"]
        Add-IsPresetValue -CollectionEntity $Collection["SafeLinksPolicy"] 
    }

    Return $Collection
}

Function Add-IsPresetValue
{
    Param (
        $CollectionEntity
    )

    # List of preset names
    $PresetNames = @("Standard Preset Security Policy","Strict Preset Security Policy","Built-In Protection Policy")

    foreach($item in $CollectionEntity)
    {
        
        if($null -ne $item.Name)
        {
            $IsPreset = $PresetNames -contains $item.Name

            $item | Add-Member -MemberType NoteProperty -Name IsPreset -Value $IsPreset
        }
        
    }
}

Function Get-ORCAReport
{

    <#
     
        .SYNOPSIS
            The Office 365 Recommended Configuration Analyzer (ORCA)
 
        .DESCRIPTION
            Office 365 Recommended Configuration Analyzer (ORCA)
 
            The Get-ORCAReport command generates a HTML report based on the Microsoft Defender for Office 365 recommended practices article:
            https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365-atp
 
            Output report uses open source components for HTML formatting:
            - Bootstrap - MIT License https://getbootstrap.com/docs/4.0/about/license/
            - Fontawesome - CC BY 4.0 License - https://fontawesome.com/license/free
 
        .PARAMETER NoConnect
            Prevents ORCA from connecting automatically to Exchange Online. In most circumstances you will not want to do this, we will
            detect if you're connected or not connected as part of running ORCA. Connection will only occur if we detect you are not
            connected.
         
        .PARAMETER NoVersionCheck
            Prevents ORCA from determining if it's running the latest version. It's always very important to be running the latest
            version of ORCA. We will change guidelines as the product and the recommended practices article changes. Not running the
            latest version might provide recommendations that are no longer valid.
 
        .PARAMETER AlternateDNS
            Will perform DNS checks using an alternate DNS server. This is really important if your organisation uses split DNS. Checks
            for your DKIM deployment for instance might fail if your DNS resolver is resolving your domains to the internal zone. This is
            because your internal zone doesn't require to have the DKIM selector records published. In these instances use the AlternateDNS
            flag to use different resolvers (ones that will provide the external DNS records for your domains).
 
        .PARAMETER DelegatedOrganization
            Passes the DelegatedOrganization when connecting to Exchange Online. The DelegatedOrganization parameter specifies the customer organization
            that you want to manage (for example, contosoelectronics.onmicrosoft.com).
 
            Only use this param when connecting to organizations that you have access to.
 
        .PARAMETER ExchangeEnvironmentName
        This will generate MCCA report for Security & Compliance Center PowerShell in a Microsoft 365 DoD organization or Microsoft GCC High organization
         O365USGovDoD
           This will generate MCCA report for Security & Compliance Center PowerShell in a Microsoft 365 DoD organization.
         O365USGovGCCHigh
           This will generate MCCA report for Security & Compliance Center PowerShell in a Microsoft GCC High organization.
 
        .PARAMETER NoSurvey
            We need your input in to ORCA, but we appreciate that you may not have the time or desire to provide it. We've added this flag in here so that you
            can suppress survey prompts (please fill out the survey though!).
 
        .PARAMETER Collection
            Internal only.
 
        .EXAMPLE
            Get-ORCAReport
 
        .EXAMPLE
            Get-ORCAReport -AlternateDNS @("10.20.30.40","40.20.30.10")
 
     
    #>

    Param(
        [CmdletBinding()]
        [Switch]$NoConnect,
        [Switch]$NoVersionCheck,
        [Switch]$NoSurvey,
        [String[]]$AlternateDNS,
        [String]$DelegatedOrganization=$null,
        [string][validateset('O365Default', 'O365USGovDoD', 'O365USGovGCCHigh','O365GermanyCloud','O365China')] $ExchangeEnvironmentName = 'O365Default',
        $Collection
    )

    try { $statusCode = wget https://aka.ms/orca-execution -Method head | % { $_.StatusCode } }catch {}

    # Easy to use for quick ORCA report to HTML
    If($NoVersionCheck)
    {
        $PerformVersionCheck = $False
    }
    Else
    {
        $PerformVersionCheck = $True
    }

    if($NoSurvey)
    {
        $ShowSurvey = $False
    } else {
        $ShowSurvey = $True
    }

    $Connect = $False

    if(!$NoConnect)
    {
        # Determine if to connect

        if($(Get-EXConnectionStatus) -eq $False)
        {
            $Connect = $True
        } else {
            # Check delegated organization specified, and we are connected to this organization.

            if(![string]::IsNullOrEmpty($DelegatedOrganization))
            {
                $OrgID = (Get-OrganizationConfig).Identity

                if($OrgID -ne $DelegatedOrganization)
                {
                    Write-Host "Connected to $($OrgID) not delegated organization $($DelegatedOrganization), reconnecting.."
                    Disconnect-ExchangeOnline -Confirm:$False
                    $Connect = $True
                }
            }
        }
    }

    $Result = Invoke-ORCA -Connect $Connect -PerformVersionCheck $PerformVersionCheck -AlternateDNS $AlternateDNS -Collection $Collection -ExchangeEnvironmentName $ExchangeEnvironmentName -Output @("HTML") -DelegatedOrganization $DelegatedOrganization -ShowSurvey $ShowSurvey
    Write-Host "$(Get-Date) Complete! Output is in $($Result.Result)"

    # Pre-requisite checks
    if(!(Get-Command Resolve-DnsName -ErrorAction:SilentlyContinue))
    {
        Write-Warning "Resolve-DnsName command does not exist on this ORCA computer. On non windows machines, this command may not exist. Commands requiring DNS checks such as DKIM and SPF have failed! Follow instructions specific for your Operating System."
    }
}

class PolicyInfo {
    # Policy applies to something, is enabled, has a rule
    [bool] $Applies

    # Preset policy (Standard or Strict)
    [bool] $Preset

    # Preset level if applicable
    [PresetPolicyLevel] $PresetLevel

    # Built in policy (BIP)
    [bool] $BuiltIn

    # Default policy
    [bool] $Default
    [String] $Name
    [PolicyType] $Type
}

Function Get-PolicyStateInt
{
    <#
    .SYNOPSIS
        Called by Get-PolicyStates to process a policy
    #>

    Param(
        $Policies,
        $Rules,
        $ProtectionPolicyRules,
        $BuiltInProtectionRule,
        [PolicyType]$Type
    )

    $ReturnPolicies = @{}

    foreach($Policy in $Policies)
    {

        $Applies = $false
        $Default = $false
        $Preset = $false
        $PresetPolicyLevel = [PresetPolicyLevel]::None
        $BuiltIn = ($Policy.Identity -eq $BuiltInProtectionRule.SafeAttachmentPolicy -or $Policy.Identity -eq $BuiltInProtectionRule.SafeLinksPolicy)
        $Name = $Policy.Name

        # Determine preset - MDO
        if($Type -eq [PolicyType]::SafeLinks -or $Type -eq [PolicyType]::SafeAttachments)
        {
            $MatchingPolicyRule = @($ProtectionPolicyRules | Where-Object {$_.SafeAttachmentsPolicy -eq $Policy.Identity -or $_.SafeLinksPolicy -eq $Policy.Identity})
            
            if($MatchingPolicyRule.Count -gt 0)
            {
                $Preset = $True
                $Name = $MatchingPolicyRule[0].Name
            }
        }

        # Determine preset - EOP
        if($Type -eq [PolicyType]::Antiphish -or $Type -eq [PolicyType]::Spam -or $Type -eq [PolicyType]::Malware)
        {
            $MatchingPolicyRule = @($ProtectionPolicyRules | Where-Object {
                $_.HostedContentFilterPolicy -eq $Policy.Identity -or 
                $_.AntiPhishPolicy -eq $Policy.Identity -or
                $_.MalwareFilterPolicy -eq $Policy.Identity
            })
            
            if($MatchingPolicyRule.Count -gt 0)
            {
                $Preset = $True
                $Name = $MatchingPolicyRule[0].Name
            }
        }

        # Determine level of preset based on name
        if($Preset)
        {
            if($Name -like "Standard*")
            {
                $PresetPolicyLevel = ([PresetPolicyLevel]::Standard)
            }
            if($Name -like "Strict*")
            {
                $PresetPolicyLevel = ([PresetPolicyLevel]::Strict)
            }
        }

        # Built in rules always apply
        if($BuiltIn)
        {
            $Applies = $True
        }

        # Checks for default policies EOP
        if(
            $Policy.DistinguishedName.StartsWith("CN=Default,CN=Malware Filter,CN=Transport Settings") -or 
            $Policy.DistinguishedName.StartsWith("CN=Default,CN=Hosted Content Filter,CN=Transport Settings") -or
            $Policy.DistinguishedName.StartsWith("CN=Default,CN=Outbound Spam Filter,CN=Transport Settings"))
        {
            $Default = $True
            $Applies = $True
        }

        # Check for default policies MDO
        if ($Policy.DistinguishedName.StartsWith("CN=Office365 AntiPhish Default,CN=AntiPhish,CN=Transport Settings,CN=Configuration"))
        {
            $Default = $True
            
            # Policy will apply based on Enabled state
            $Applies = $Policy.Enabled
        }

        # If not applying - check rules for application
        if(!$Applies)
        {

            # If Preset, rules to check is the protection policy rules (ATP or EOP protection policy rules), if not, the policy rules.
            if($Preset)
            {
                $CheckRules = $ProtectionPolicyRules
            } else {
                $CheckRules = $Rules
            }

            foreach($Rule in $($CheckRules | Where-Object {$_.Name -eq $Policy.Name}))
            {
                if($Rule.State -eq "Enabled")
                {
                    if($Rule.SentTo.Count -gt 0 -or $Rule.SentToMemberOf.Count -gt 0 -or $Rule.RecipientDomainIs.Count -gt 0)
                    {
                        $Applies = $true
                    }

                    # Outbound spam uses From, FromMemberOf and SenderDomainIs conditions
                    if($Type -eq [PolicyType]::OutboundSpam)
                    {
                        if($Rule.From.Count -gt 0 -or $Rule.FromMemberOf.Count -gt 0 -or $Rule.SenderDomainIs.Count -gt 0)
                        {
                            $Applies = $true
                        }
                    }
                }
            }
        }

        $ReturnPolicies[$Policy.Guid.ToString()] = New-Object -TypeName PolicyInfo -Property @{
            Applies=$Applies
            Preset=$Preset
            PresetLevel=($PresetPolicyLevel)
            BuiltIn=$BuiltIn
            Default=$Default
            Name=$Name 
            Type=$Type
        }
    }

    return $ReturnPolicies
}

Function Get-PolicyStates
{
    <#
    .SYNOPSIS
        Returns hashtable of all policy GUIDs and if they are applied
    #>

    Param(
        $AntiphishPolicies,
        $AntiphishRules,
        $AntimalwarePolicies,
        $AntimalwareRules,
        $AntispamPolicies,
        $AntispamRules,
        $OutboundSpamPolicies,
        $OutboundSpamRules,
        $SafeLinksPolicies,
        $SafeLinksRules,
        $SafeAttachmentsPolicies,
        $SafeAttachmentRules,
        $ProtectionPolicyRulesATP,
        $ProtectionPolicyRulesEOP,
        $BuiltInProtectionRule
    )

    $ReturnPolicies = @{}

    $ReturnPolicies += Get-PolicyStateInt -Policies $AntiphishPolicies -Rules $AntiphishRules -Type ([PolicyType]::Antiphish) -ProtectionPolicyRules $ProtectionPolicyRulesEOP -BuiltInProtectionRule $BuiltInProtectionRule
    $ReturnPolicies += Get-PolicyStateInt -Policies $AntimalwarePolicies -Rules $AntimalwareRules -Type ([PolicyType]::Malware) -ProtectionPolicyRules $ProtectionPolicyRulesEOP
    $ReturnPolicies += Get-PolicyStateInt -Policies $AntispamPolicies -Rules $AntispamRules -Type ([PolicyType]::Spam) -ProtectionPolicyRules $ProtectionPolicyRulesEOP
    $ReturnPolicies += Get-PolicyStateInt -Policies $SafeLinksPolicies -Rules $SafeLinksRules -Type ([PolicyType]::SafeLinks) -ProtectionPolicyRules $ProtectionPolicyRulesATP -BuiltInProtectionRule $BuiltInProtectionRule
    $ReturnPolicies += Get-PolicyStateInt -Policies $SafeAttachmentsPolicies -Rules $SafeAttachmentRules -Type ([PolicyType]::SafeAttachments) -ProtectionPolicyRules $ProtectionPolicyRulesATP -BuiltInProtectionRule $BuiltInProtectionRule
    $ReturnPolicies += Get-PolicyStateInt -Policies $OutboundSpamPolicies -Rules $OutboundSpamRules -Type ([PolicyType]::OutboundSpam) -ProtectionPolicyRules $ProtectionPolicyRulesATP -BuiltInProtectionRule $BuiltInProtectionRule

    return $ReturnPolicies
}

function Get-AnyPolicyState
{
    <#
    .SYNOPSIS
        Returns if any policy is enabled and applies
    #>

    Param(
        $PolicyStates
    )

    $ReturnVals = @{}
    $ReturnVals[[PolicyType]::Antiphish] = $False
    $ReturnVals[[PolicyType]::Malware] = $False
    $ReturnVals[[PolicyType]::Spam] = $False
    $ReturnVals[[PolicyType]::SafeAttachments] = $False
    $ReturnVals[[PolicyType]::SafeLinks] = $False

    foreach($Key in $PolicyStates.Keys)
    {

        if($PolicyStates[$Key].Type -eq [PolicyType]::Antiphish -and $PolicyStates[$Key].Applies)
        {
            $ReturnVals[[PolicyType]::Antiphish] = $True
        }

        if($PolicyStates[$Key].Type -eq [PolicyType]::Malware -and $PolicyStates[$Key].Applies)
        {
            $ReturnVals[[PolicyType]::Malware] = $True
        }

        if($PolicyStates[$Key].Type -eq [PolicyType]::Spam -and $PolicyStates[$Key].Applies)
        {
            $ReturnVals[[PolicyType]::Spam] = $True
        }

        if($PolicyStates[$Key].Type -eq [PolicyType]::SafeAttachments -and $PolicyStates[$Key].Applies)
        {
            $ReturnVals[[PolicyType]::SafeAttachments] = $True
        }

        if($PolicyStates[$Key].Type -eq [PolicyType]::SafeLinks -and $PolicyStates[$Key].Applies)
        {
            $ReturnVals[[PolicyType]::SafeLinks]  = $True
        }
    }

    return $ReturnVals;

}

Function Invoke-ORCA
{

    <#
     
        .SYNOPSIS
            The Office 365 Recommended Configuration Analyzer (ORCA)
 
        .DESCRIPTION
            Office 365 Recommended Configuration Analyzer (ORCA)
 
            Unless you are wanting to automate ORCA, do not use Invoke-ORCA, run Get-ORCAReport instead!!
 
            The Invoke-ORCA command allows you to output different formats based on the Microsoft Defender for Office 365 recommended practices article:
            https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365-atp
 
            HTML Output report uses open source components for HTML formatting:
            - Bootstrap - MIT License https://getbootstrap.com/docs/4.0/about/license/
            - Fontawesome - CC BY 4.0 License - https://fontawesome.com/license/free
 
        .PARAMETER Output
            Array of output modules you would like to invoke. You can specify multiple different outputs. Outputs are modular, and
            additional outputs can be written and placed in the modules Outputs directory if required.
 
            Out of the box, the following outputs are included
            - HTML
            - JSON (File)
            - Cosmos DB (Requires CosmosDB third-party module)
 
            As this is an array, you can specify different outputs
             
            -Output "HTML"
                Will output just HTML
            -Output @("HTML","JSON")
                Will output the HTML report and the JSON report
         
        .PARAMETER OutputOptions
            Array of options for the output modules.
 
            Example if running a Cosmos output, you'll need to tell it which account, database and key to use like this:
 
            -OutputOptions @{Cosmos=@{Account='MyCosmosAccount';Database='MyCosmosDB';Key='<Your key>';Collection='MyORCA'}}
 
            If you're running multiple different outputs, just use a different key for that output module, for instance this will provide the Cosmos details to the Cosmos module
            and HTML details to the HTML module.
 
            -OutputOptions @{HTML=@{DisplayReport=$False};Cosmos=@{Account='MyCosmosAccount';Database='MyCosmosDB';Key='<Your key>';Collection='MyORCA'}}
         
        .PARAMETER PerformVersionCheck
            Prevents ORCA from determining if it's running the latest version if set to $False. It's always very important to be running the latest
            version of ORCA. We will change guidelines as the product and the recommended practices article changes. Not running the
            latest version might provide recommendations that are no longer valid.
 
        .PARAMETER Connect
            Prevents ORCA from connecting automatically to Exchange Online if set to $False. In most circumstances you will not want to do this, we will
            detect if you're connected or not connected as part of running ORCA. Connection will only occur if we detect you are not
            connected.
 
        .PARAMETER AlternateDNS
            Will perform DNS checks using an alternate DNS server. This is really important if your organisation uses split DNS. Checks
            for your DKIM deployment for instance might fail if your DNS resolver is resolving your domains to the internal zone. This is
            because your internal zone doesn't require to have the DKIM selector records published. In these instances use the AlternateDNS
            flag to use different resolvers (ones that will provide the external DNS records for your domains).
 
        .PARAMETER InstallModules
            Attempts to install missing modules (such as Exchange Online Management) in to the CurrentUser scope if they are missing. Defaults to $True
 
        .PARAMETER DelegatedOrganization
            Passes the DelegatedOrganization when connecting to Exchange Online. The DelegatedOrganization parameter specifies the customer organization
            that you want to manage (for example, contosoelectronics.onmicrosoft.com).
 
            Only use this param when connecting to organizations that you have access to.
 
        .PARAMETER Collection
            Internal only.
 
        .EXAMPLE
            Invoke-ORCA -Output "HTML"
 
        .EXAMPLE
            Invoke-ORCA -Output @("HTML","JSON")
 
        .EXAMPLE
            Invoke-ORCA -Output @("HTML","JSON") -OutputOptions @{HTML=@{DisplayReport=$False}}
 
        .EXAMPLE
            Invoke-ORCA -Output "COSMOS" -OutputOptions @{HTML=@{DisplayReport=$False};Cosmos=@{Account='MyCosmosAccount';Database='MyCosmosDB';Key='YourKeyvalue';Collection='MyORCA'}}
 
     
    #>

    Param(
        [CmdletBinding()]
        [Boolean]$Connect=$True,
        [Boolean]$PerformVersionCheck=$True,
        [Boolean]$InstallModules=$True,
        [Boolean]$ShowSurvey=$True,
        [String[]]$AlternateDNS,
        [String]$DelegatedOrganization=$null,
        [string][validateset('O365Default', 'O365USGovDoD', 'O365USGovGCCHigh')] $ExchangeEnvironmentName,
        $Output,
        $OutputOptions,
        $Collection
    )

    # Version check
    $VersionCheck = Invoke-ORCAVersionCheck -GalleryCheck $PerformVersionCheck

    If($Connect)
    {
        Invoke-ORCAConnections  -ExchangeEnvironmentName $ExchangeEnvironmentName -Install $InstallModules -DelegatedOrganization $DelegatedOrganization
    }

    # Build a param object which can be used to pass params to the underlying classes
    $ORCAParams = New-Object -TypeName PSObject -Property @{
        AlternateDNS=$AlternateDNS
    }

    # Get the output modules
    $OutputModules = Get-ORCAOutputs -VersionCheck $VersionCheck -Modules $Output -Options $OutputOptions -ShowSurvey $ShowSurvey

    # Get the object of ORCA checks
    $Checks = Get-ORCACheckDefs -ORCAParams $ORCAParams

    # Get the collection in to memory. For testing purposes, we support passing the collection as an object
    If($Null -eq $Collection)
    {
        $Collection = Get-ORCACollection
    }

    # Perform checks inside classes/modules
    ForEach($Check in ($Checks | Sort-Object Area))
    {

        # Run EOP checks by default
        if($check.Services -band [ORCAService]::EOP)
        {
            $Check.Run($Collection)
        }

        # Run ATP checks only when ATP is present
        if($check.Services -band [ORCAService]::OATP -and $Collection["Services"] -band [ORCAService]::OATP)
        {
            $Check.Run($Collection)
        }
    }

    # Manipulation of check results for disable/read-only


    <#
     
        The Configuration Health Index
 
        Each configuration has a score, the CHISum below is a summary of the score based on each check.
        To gain the points in the score, the check must pass or be informational, fail checks do not count.
 
        The Configuration Health Index is the percentage of CHISum and the total points that are available.
     
    #>

    # Generate the CHI value
    $CHITotal = 0
    $CHISum = 0

    ForEach($Check in ($Checks))
    {
        $CHITotal += $($Check.Config.Count) * $($Check.ChiValue)
        $CHISum += $($Check.InfoCount + $Check.PassCount) * $($Check.ChiValue)
    }

    $CHI = [Math]::Round($($CHISum / $CHITotal) * 100)

    $Collection["CHI"] = $($CHI)

    $OutputResults = @()

    Write-Host "$(Get-Date) Generating Output" -ForegroundColor Green
    # Perform required outputs
    ForEach($o in $OutputModules)
    {

        $o.Run($Checks,$Collection)
        $OutputResults += New-Object -TypeName PSObject -Property @{
            Name=$o.name
            Completed=$o.completed
            Result=$o.Result
        }

    }

    CountORCAStat -Domains $Collection["AcceptedDomains"] -Version $VersionCheck.Version.ToString()

    Return $OutputResults

}

function CountORCAStat
{
    Param (
        $Domains,
        [string]$Version
    )

    Write-Host $Version

    #try {
        $Command = Get-Command Get-ORCAReport
        $Channel = $Command.Source
        if($Channel -eq "ORCA" -and $Command.Version -eq "0.0") { $Channel = "Dev" } else { $Channel = "Main" }
        if($Channel -eq "ORCAPreview") { $Channel = "Preview"}

        $TenantDomain = ($Domains | Where-Object {$_.InitialDomain -eq $True}).DomainName
        $mystream = [IO.MemoryStream]::new([byte[]][char[]]$TenantDomain)
        $Hash = (Get-FileHash -InputStream $mystream -Algorithm SHA256).Hash
        $Obj = New-Object -TypeName PSObject -Property @{
            id=$Hash
            Version=$Version
            Channel=$Channel
        }
        Invoke-RestMethod -Method POST -Uri "https://orcastat.azurewebsites.net/stat" -Body (ConvertTo-Json $Obj) -ContentType "application/json" | Out-Null
    #}
    #catch {
    # <#Do this if a terminating exception happens#>
    #}


}


function Invoke-ORCAVersionCheck
{
    Param
    (
        $Terminate,
        [Boolean] $GalleryCheck
    )

    Write-Host "$(Get-Date) Performing ORCA Version check..."

    # When detected we are running the preview release
    $Preview = $False

    try 
    {
        $ORCAVersion = (Get-Module ORCA | Sort-Object Version -Desc)[0].Version
    }
    catch 
    {
        $ORCAVersion = (Get-Module ORCAPreview | Sort-Object Version -Desc)[0].Version

        if($ORCAVersion)
        {
            $Preview = $True
        }
    }

    if($GalleryCheck)
    {
        if($Preview -eq $False)
        {
            $PSGalleryVersion = (Find-Module ORCA -Repository PSGallery -ErrorAction:SilentlyContinue -WarningAction:SilentlyContinue).Version
        }
        else 
        {
            $PSGalleryVersion = (Find-Module ORCAPreview -Repository PSGallery -ErrorAction:SilentlyContinue -WarningAction:SilentlyContinue).Version
        }
        
    
        If($PSGalleryVersion -gt $ORCAVersion)
        {
            $Updated = $False
            If($Terminate)
            {
                Throw "ORCA is out of date. Your version is $ORCAVersion and the published version is $PSGalleryVersion. Run Update-Module ORCA or run with -NoUpdate."
            }
            else {
                Write-Host "$(Get-Date) ORCA is out of date. Your version: $($ORCAVersion) published version is $($PSGalleryVersion)"
            }
        }
        else
        {
            $Updated = $True
        }
    }

    Return New-Object -TypeName PSObject -Property @{
        Updated=$Updated
        Version=$ORCAVersion
        GalleryCheck=$GalleryCheck
        GalleryVersion=$PSGalleryVersion
        Preview=$Preview
    }
}

function Get-EXConnectionStatus
{
    # Perform check to determine if we are connected
    Try
    {
        Get-HostedConnectionFilterPolicy -WarningAction:SilentlyContinue | Out-Null
        Return $True
    }
    Catch
    {
        Return $False
    }
}

# SIG # Begin signature block
# MIIl3wYJKoZIhvcNAQcCoIIl0DCCJcwCAQExDzANBglghkgBZQMEAgEFADB5Bgor
# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG
# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCO6LyMXynowQV6
# dtmYHXVFEFNYjzalhj4dmDRH19pvm6CCC5YwggT7MIID46ADAgECAhMzAAAFqa00
# npLOQgZDAAEAAAWpMA0GCSqGSIb3DQEBCwUAMHkxCzAJBgNVBAYTAlVTMRMwEQYD
# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy
# b3NvZnQgQ29ycG9yYXRpb24xIzAhBgNVBAMTGk1pY3Jvc29mdCBUZXN0aW5nIFBD
# QSAyMDEwMB4XDTIzMDMxNjE4NTkyN1oXDTI0MDMxNDE4NTkyN1owfDELMAkGA1UE
# BhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAc
# BgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdQ29kZSBTaWdu
# IFRlc3QgKERPIE5PVCBUUlVTVCkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
# AoIBAQCbPZMZ96mQ6KefXZagBUXbFuKwTQWwCFtvZDWAC2UeQ4xDP5m1exO2kbDh
# zldjWMn4HO+r4TRYs5pGB4i4JM1BWQb3LWPKaEXOtN84b8fTtD9Utf/msNh0IDbX
# CPMb8wVv2Vb3FuEdpXBC7UztdptBhoBVnKzIKooNM4mcaf9qQYdz+GdIhTwzKP7j
# 68WxdNKDXPsvM8zbO6kKtLxLd3e+HrOn6Vs634SYjba8xCaQyWA+whs9R6M92dU2
# HLhMxz2Sd7KPIz6RasjVqzX7oyL/ogYIvlZOnZA/yZ+P8HeNAHlUGjeoIh7QVVIu
# Q9Y3BNXx2OFxKwX3RYnsn5r6+usTAgMBAAGjggF3MIIBczATBgNVHSUEDDAKBggr
# BgEFBQcDAzAdBgNVHQ4EFgQUFfx0k/csoohO22mMZZXD+qHMO7gwRQYDVR0RBD4w
# PKQ6MDgxHjAcBgNVBAsTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEWMBQGA1UEBRMN
# MjMwMDcyKzUwMDUwNDAfBgNVHSMEGDAWgBS/ZaKrb3WjTkWWVwXPOYf0wBUcHDBc
# BgNVHR8EVTBTMFGgT6BNhktodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3Bz
# L2NybC9NaWNyb3NvZnQlMjBUZXN0aW5nJTIwUENBJTIwMjAxMCgxKS5jcmwwaQYI
# KwYBBQUHAQEEXTBbMFkGCCsGAQUFBzAChk1odHRwOi8vd3d3Lm1pY3Jvc29mdC5j
# b20vcGtpb3BzL2NlcnRzL01pY3Jvc29mdCUyMFRlc3RpbmclMjBQQ0ElMjAyMDEw
# KDEpLmNydDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQAxZjLCOUiW
# BLK3zCqmJhsLMiFt3vignHOD909KV6a8D2aKWsbk45IC2djh8dfJG5sQzsZ6PMNu
# 0zQtRw8Wef2Ii0k+3vAf1VOwkkw369d54MuFs7+E2c+8puQYXGF4Hug/98j5UhX5
# QRBwmYONzurrF8pCoxt2dKW/Hx9VdXXa3Gqvk8XsQjpXkpqCYh/GH8eTHGtul3dt
# PIUgEzvL1t4FXwo2yv2hzCw4wEgiII4yYT59WekAnohy7bvA+J6a8csw9KGvf2/z
# 5AhNLxVJ07Ga6OJkMDsWZWq2wNlHXiSR8QC2x2aczoFpGRzgBJTkuBYR5rS/hJjp
# Q/4wZN/cj8e4MIIGkzCCBHugAwIBAgITMwAAAC01ekaIyQdx2AAAAAAALTANBgkq
# hkiG9w0BAQsFADCBkDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24x
# EDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlv
# bjE6MDgGA1UEAxMxTWljcm9zb2Z0IFRlc3RpbmcgUm9vdCBDZXJ0aWZpY2F0ZSBB
# dXRob3JpdHkgMjAxMDAeFw0yMDEyMTAyMDQzMjBaFw0zNTA2MTcyMTA0MTFaMHkx
# CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRt
# b25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xIzAhBgNVBAMTGk1p
# Y3Jvc29mdCBUZXN0aW5nIFBDQSAyMDEwMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
# MIIBCgKCAQEAvzxggau+7P/XF2PypkLRE2KcsBfOukYaeyIuVXOaVLnG1NHKmP53
# Rw2OnfBezPhU7/LPKtRi8ak0CgTXxQWG8hD1TdOWCGaF2wJ9GNzieiOnmildrnkY
# zwxj8Br/gampQz+pC7lR8bNIOvxELl8RxVY6/8oOzYgIwf3H1fU+7+pOG3KLI71F
# N54fcMGnybggc+3zbD2LIQXPdxL+odwH6Q1beAlsMlUQR9A3yMf3+nP+RjTkVhao
# N2RT1jX7w4C2jraGkaEQ1sFK9uN61BEKst4unhCX4IGuEl2IAV3MpMQoUpxg8Arm
# iK9L6VeK7KMPNx4p9l0h09faXQ7JTtuNbQIDAQABo4IB+jCCAfYwDgYDVR0PAQH/
# BAQDAgGGMBIGCSsGAQQBgjcVAQQFAgMBAAEwIwYJKwYBBAGCNxUCBBYEFOqfXzO2
# 0F+erestpsECu0A4y+e1MB0GA1UdDgQWBBS/ZaKrb3WjTkWWVwXPOYf0wBUcHDBU
# BgNVHSAETTBLMEkGBFUdIAAwQTA/BggrBgEFBQcCARYzaHR0cDovL3d3dy5taWNy
# b3NvZnQuY29tL3BraW9wcy9Eb2NzL1JlcG9zaXRvcnkuaHRtMBkGCSsGAQQBgjcU
# AgQMHgoAUwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUowEE
# fjCIM+u5MZzK64V2Z/xltNEwWQYDVR0fBFIwUDBOoEygSoZIaHR0cDovL2NybC5t
# aWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMvTWljVGVzUm9vQ2VyQXV0XzIw
# MTAtMDYtMTcuY3JsMIGNBggrBgEFBQcBAQSBgDB+ME0GCCsGAQUFBzAChkFodHRw
# Oi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Rlc1Jvb0NlckF1dF8y
# MDEwLTA2LTE3LmNydDAtBggrBgEFBQcwAYYhaHR0cDovL29uZW9jc3AubWljcm9z
# b2Z0LmNvbS9vY3NwMA0GCSqGSIb3DQEBCwUAA4ICAQAntNCFsp7MD6QqU3PVbdrX
# MQDI9v9jyPYBEbUYktrctPmvJuj8Snm9wWewiAN5Zc81NQVYjuKDBpb1un4SWVCb
# 4PDVPZ0J87tGzYe9dOJ30EYGeiIaaStkLLmLOYAM6oInIqIwVyIk2SE/q2lGt8Ov
# wcZevNmPkVYjk6nyJi5EdvS6ciPRmW9bRWRT4pWU8bZIQL938LE4lHOQAixrAQiW
# es5Szp2U85E0nLdaDr5w/I28J/Z1+4zW1Nao1prVCOqrosnoNUfVf1kvswfW3FY2
# l1PiAYp8sGyO57GaztXdBoEOBcDLedfcPra9+NLdEF36NkE0g+9dbokFY7KxhUJ8
# WpMiCmN4yj9LKFLvQbctGMJJY9EwHFifm2pgaiaafKF1Gyz+NruJzEEgpysMo/f9
# AVBQ/qCdPQQGEWp3QDIaef4ts9QTx+RmDKCBDMTFLgFmmhbtUY0JWjLkKn7soz/L
# IcDUle/p5TiFD4VhfZnAcvYQHXfuslnyp+yuhWzASnAQNnOIO6fc1JFIwkDkcM+k
# /TspfAajzHooSAwXkrOWrjRDV6wI0YzMVHrEyQ0hZ5NnIXbL3lrTkOPjf3NBu1na
# SNEaySduStDbFVjV3TXoENEnZiugJKYSwmhzoYHM1ngipN5rNdqJiK5ukp6E8LDz
# i3l5/7XctJQY3+ZgHDJosjGCGZ8wghmbAgEBMIGQMHkxCzAJBgNVBAYTAlVTMRMw
# EQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVN
# aWNyb3NvZnQgQ29ycG9yYXRpb24xIzAhBgNVBAMTGk1pY3Jvc29mdCBUZXN0aW5n
# IFBDQSAyMDEwAhMzAAAFqa00npLOQgZDAAEAAAWpMA0GCWCGSAFlAwQCAQUAoIGw
# MBkGCSqGSIb3DQEJAzEMBgorBgEEAYI3AgEEMBwGCisGAQQBgjcCAQsxDjAMBgor
# BgEEAYI3AgEVMC8GCSqGSIb3DQEJBDEiBCBvwlws8I9iImvQQMektcXGOJeYikK1
# kDuowTGSK4ldpDBEBgorBgEEAYI3AgEMMTYwNKAUgBIATQBpAGMAcgBvAHMAbwBm
# AHShHIAaaHR0cHM6Ly93d3cubWljcm9zb2Z0LmNvbSAwDQYJKoZIhvcNAQEBBQAE
# ggEAG2DKh0NcUuNAwdcdUO+SDVRHpOyXlTQQa2D5EB2ZamXRCTi2uolB5/laLu3K
# LkornDi5pu8CovMeYP+grX5+/b5N97AtG+a7lK6qfp2QsEcjmdSRGPqEYXr4TU72
# UKn/KdpPR+45STzlV4+O6uJaWeCtu8rE/9o7bRxfb/bRthYCKkRB9TvKhROUtwCJ
# oFcFTqura+b1uCdgdpsdT1H7+3ZSL5MocJRI5VpJwuzxXZ6DFXRCEjzQzknkVkII
# VlTcRH11/x8TPj/sW+xzGk/MfTrk87yCIdR3+mkFninTadhgiqlqPGhzemb4lBTT
# GROm4R7dPYnRvVqUJs+BL6n+/aGCFywwghcoBgorBgEEAYI3AwMBMYIXGDCCFxQG
# CSqGSIb3DQEHAqCCFwUwghcBAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFZBgsqhkiG
# 9w0BCRABBKCCAUgEggFEMIIBQAIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFlAwQC
# AQUABCAf/qpcIQ+eMSJuL1iUTHfMFgW4IubNw4Rs05njECB5fgIGZGzyj67PGBMy
# MDIzMDYwNTEwMjEyNy4wNzZaMASAAgH0oIHYpIHVMIHSMQswCQYDVQQGEwJVUzET
# MBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMV
# TWljcm9zb2Z0IENvcnBvcmF0aW9uMS0wKwYDVQQLEyRNaWNyb3NvZnQgSXJlbGFu
# ZCBPcGVyYXRpb25zIExpbWl0ZWQxJjAkBgNVBAsTHVRoYWxlcyBUU1MgRVNOOkZD
# NDEtNEJENC1EMjIwMSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2
# aWNloIIRezCCBycwggUPoAMCAQICEzMAAAG59gANZVRPvAMAAQAAAbkwDQYJKoZI
# hvcNAQELBQAwfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAO
# BgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEm
# MCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwHhcNMjIwOTIw
# MjAyMjE3WhcNMjMxMjE0MjAyMjE3WjCB0jELMAkGA1UEBhMCVVMxEzARBgNVBAgT
# Cldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29m
# dCBDb3Jwb3JhdGlvbjEtMCsGA1UECxMkTWljcm9zb2Z0IElyZWxhbmQgT3BlcmF0
# aW9ucyBMaW1pdGVkMSYwJAYDVQQLEx1UaGFsZXMgVFNTIEVTTjpGQzQxLTRCRDQt
# RDIyMDElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2VydmljZTCCAiIw
# DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAONJPslh9RbHyQECbUIINxMF5uQk
# yN07VIShITXubLpWnANgBCLvCcJl7o/2HHORnsRcmSINJ/qclAmLIrOjnYnrbocA
# nixiMEXC+a1sZ84qxYWtEVY7VYw0LCczY+86U/8shgxqsaezKpWriPOcpV1Sh8Ss
# Oxf30yO7jvld/IBA3T6lHM2pT/HRjWk/r9uyx0Q4atx0mkLVYS9y55/oTlKLE00h
# 792S+maadAdy3VgTweiwoEOXD785wv3h+fwH/wTQtC9lhAxhMO4p+OP9888Wxkbl
# 6BqRWXud54RTzqp2Vr+yen1Q1A6umyMB7Xq0snIYG5B1Acc4UgJlPQ/ZiMkqgxQN
# FCWQvz0G9oLgSPD8Ky0AkX22PcDOboPuNT4RceWPX0UVZUsX9IUgs7QF41HiQSwE
# eOOHGyrfQdmSslATrbmH/18M5QrsTM5JINjct9G42xqN8VF9Z8WOiGMjNbvlpcEm
# mysYl5QyhrEDoFnQTU7bFrD3JX0fIfu1sbLWeBqXwbp4Z8yACTtphK2VbzOvi4vc
# 0RCmRNzvYQQ2PjZ7NaTXE4Gu3vggAJ+rtzUTAfJotvOSqcMgNwLZa1Y+ET/lb0Vy
# jrYwFuHtg0QWyQjP5350LTpv086pyVUh4A3w/Os5hTGFZgFe5bCyMnpY09M0yPdH
# aQ/56oYUsSIcyKyVAgMBAAGjggFJMIIBRTAdBgNVHQ4EFgQUt7A4cdtYQ5oJjE1Z
# qrSonp41RFIwHwYDVR0jBBgwFoAUn6cVXQBeYl2D9OXSZacbUzUZ6XIwXwYDVR0f
# BFgwVjBUoFKgUIZOaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwv
# TWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUyMDIwMTAoMSkuY3JsMGwGCCsG
# AQUFBwEBBGAwXjBcBggrBgEFBQcwAoZQaHR0cDovL3d3dy5taWNyb3NvZnQuY29t
# L3BraW9wcy9jZXJ0cy9NaWNyb3NvZnQlMjBUaW1lLVN0YW1wJTIwUENBJTIwMjAx
# MCgxKS5jcnQwDAYDVR0TAQH/BAIwADAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCDAO
# BgNVHQ8BAf8EBAMCB4AwDQYJKoZIhvcNAQELBQADggIBAM3cZ7NFUHRMsLKzjl7r
# JPIkv7oJ+s9kkut0hZif9WSt60SzYGULp1zmdPqc+w8eHTkhqX0GKCp2TTqSzBXB
# hwHOm8+p6hUxNlDewGMZUos952aTXblAT3OKBnfVBLQyUavrSjuJGZAW30cNY3rj
# VDUlGD+VygQHySaDaviJQbK6/6fQvUUFoqIk3ldGfjnAtnebsVlqh6WWamVc5AZd
# pWR1jSzN/oxKYqc1BG4SxxlPtcfrAdBz/cU4bxVXqAAf02NZscvJNpRnOALf5kVo
# 2HupJXCsk9TzP5PNW2sTS3TmwhIQmPxr0E0UqOojUrBJUOhbITAxcnSa/IMluL1H
# XRtLQZI+xs2eRtuPOUsKUW71/1YeqsYCLHLvu82ceDVQQvP7GHEEkp2kEjiofbjY
# ErBo2iCEaxxeX4Z9HvAgA4MsQkbn6e4EFQf13sP+Kn3XgMIvJbqLJeFcQja+SUeO
# Xu5cfkxe0GzTNojdyIwzaHlhOflVRZNrxee3B+yZwd3JHDIvv71uSI/SIzzt9cU2
# GyHQVqxBSrRtKW6W8Vw7zpVvoVsIv3ljxg+7NiGSlXX1s7zbBNDMUj9OnzOlHK/3
# mrOU8YEuRf6RwakW5UCeGamy5MiKu2YuyKiGBCv4OGhPstNe7ALkEOh8BX12t4nt
# uYu+gw9L6yCPY0jWYaQtzAP9MIIHcTCCBVmgAwIBAgITMwAAABXF52ueAptJmQAA
# AAAAFTANBgkqhkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldh
# c2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBD
# b3Jwb3JhdGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNhdGUg
# QXV0aG9yaXR5IDIwMTAwHhcNMjEwOTMwMTgyMjI1WhcNMzAwOTMwMTgzMjI1WjB8
# MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVk
# bW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1N
# aWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDCCAiIwDQYJKoZIhvcNAQEBBQAD
# ggIPADCCAgoCggIBAOThpkzntHIhC3miy9ckeb0O1YLT/e6cBwfSqWxOdcjKNVf2
# AX9sSuDivbk+F2Az/1xPx2b3lVNxWuJ+Slr+uDZnhUYjDLWNE893MsAQGOhgfWpS
# g0S3po5GawcU88V29YZQ3MFEyHFcUTE3oAo4bo3t1w/YJlN8OWECesSq/XJprx2r
# rPY2vjUmZNqYO7oaezOtgFt+jBAcnVL+tuhiJdxqD89d9P6OU8/W7IVWTe/dvI2k
# 45GPsjksUZzpcGkNyjYtcI4xyDUoveO0hyTD4MmPfrVUj9z6BVWYbWg7mka97aSu
# eik3rMvrg0XnRm7KMtXAhjBcTyziYrLNueKNiOSWrAFKu75xqRdbZ2De+JKRHh09
# /SDPc31BmkZ1zcRfNN0Sidb9pSB9fvzZnkXftnIv231fgLrbqn427DZM9ituqBJR
# 6L8FA6PRc6ZNN3SUHDSCD/AQ8rdHGO2n6Jl8P0zbr17C89XYcz1DTsEzOUyOArxC
# aC4Q6oRRRuLRvWoYWmEBc8pnol7XKHYC4jMYctenIPDC+hIK12NvDMk2ZItboKaD
# IV1fMHSRlJTYuVD5C4lh8zYGNRiER9vcG9H9stQcxWv2XFJRXRLbJbqvUAV6bMUR
# HXLvjflSxIUXk8A8FdsaN8cIFRg/eKtFtvUeh17aj54WcmnGrnu3tz5q4i6tAgMB
# AAGjggHdMIIB2TASBgkrBgEEAYI3FQEEBQIDAQABMCMGCSsGAQQBgjcVAgQWBBQq
# p1L+ZMSavoKRPEY1Kc8Q/y8E7jAdBgNVHQ4EFgQUn6cVXQBeYl2D9OXSZacbUzUZ
# 6XIwXAYDVR0gBFUwUzBRBgwrBgEEAYI3TIN9AQEwQTA/BggrBgEFBQcCARYzaHR0
# cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9Eb2NzL1JlcG9zaXRvcnkuaHRt
# MBMGA1UdJQQMMAoGCCsGAQUFBwMIMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBB
# MAsGA1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQYMBaAFNX2VsuP
# 6KJcYmjRPZSQW9fOmhjEMFYGA1UdHwRPME0wS6BJoEeGRWh0dHA6Ly9jcmwubWlj
# cm9zb2Z0LmNvbS9wa2kvY3JsL3Byb2R1Y3RzL01pY1Jvb0NlckF1dF8yMDEwLTA2
# LTIzLmNybDBaBggrBgEFBQcBAQROMEwwSgYIKwYBBQUHMAKGPmh0dHA6Ly93d3cu
# bWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljUm9vQ2VyQXV0XzIwMTAtMDYtMjMu
# Y3J0MA0GCSqGSIb3DQEBCwUAA4ICAQCdVX38Kq3hLB9nATEkW+Geckv8qW/qXBS2
# Pk5HZHixBpOXPTEztTnXwnE2P9pkbHzQdTltuw8x5MKP+2zRoZQYIu7pZmc6U03d
# mLq2HnjYNi6cqYJWAAOwBb6J6Gngugnue99qb74py27YP0h1AdkY3m2CDPVtI1Tk
# eFN1JFe53Z/zjj3G82jfZfakVqr3lbYoVSfQJL1AoL8ZthISEV09J+BAljis9/kp
# icO8F7BUhUKz/AyeixmJ5/ALaoHCgRlCGVJ1ijbCHcNhcy4sa3tuPywJeBTpkbKp
# W99Jo3QMvOyRgNI95ko+ZjtPu4b6MhrZlvSP9pEB9s7GdP32THJvEKt1MMU0sHrY
# UP4KWN1APMdUbZ1jdEgssU5HLcEUBHG/ZPkkvnNtyo4JvbMBV0lUZNlz138eW0QB
# jloZkWsNn6Qo3GcZKCS6OEuabvshVGtqRRFHqfG3rsjoiV5PndLQTHa1V1QJsWkB
# RH58oWFsc/4Ku+xBZj1p/cvBQUl+fpO+y/g75LcVv7TOPqUxUYS8vwLBgqJ7Fx0V
# iY1w/ue10CgaiQuPNtq6TPmb/wrpNPgkNWcr4A245oyZ1uEi6vAnQj0llOZ0dFtq
# 0Z4+7X6gMTN9vMvpe784cETRkPHIqzqKOghif9lwY1NNje6CbaUFEMFxBmoQtB1V
# M1izoXBm8qGCAtcwggJAAgEBMIIBAKGB2KSB1TCB0jELMAkGA1UEBhMCVVMxEzAR
# BgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1p
# Y3Jvc29mdCBDb3Jwb3JhdGlvbjEtMCsGA1UECxMkTWljcm9zb2Z0IElyZWxhbmQg
# T3BlcmF0aW9ucyBMaW1pdGVkMSYwJAYDVQQLEx1UaGFsZXMgVFNTIEVTTjpGQzQx
# LTRCRDQtRDIyMDElMCMGA1UEAxMcTWljcm9zb2Z0IFRpbWUtU3RhbXAgU2Vydmlj
# ZaIjCgEBMAcGBSsOAwIaAxUAx2IeGHhk58MQkzzSWknGcLjfgTqggYMwgYCkfjB8
# MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVk
# bW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSYwJAYDVQQDEx1N
# aWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMDANBgkqhkiG9w0BAQUFAAIFAOgn
# 6uEwIhgPMjAyMzA2MDUxMzAyMjVaGA8yMDIzMDYwNjEzMDIyNVowdzA9BgorBgEE
# AYRZCgQBMS8wLTAKAgUA6Cfq4QIBADAKAgEAAgIBDQIB/zAHAgEAAgIRdzAKAgUA
# 6Ck8YQIBADA2BgorBgEEAYRZCgQCMSgwJjAMBgorBgEEAYRZCgMCoAowCAIBAAID
# B6EgoQowCAIBAAIDAYagMA0GCSqGSIb3DQEBBQUAA4GBAGuVC5yyw9Op3DiW73XB
# b13Vp35e7GrVE+/WqgBngI/UMGYkkPevbmszTX3BHCQMaqntdwRewWHHntHjY4s7
# 2UEZ/lhUvkG7FYB34oY2hQ/eitIndFMVs79g7OCYi5HwdQdmsdAimGeDtrzCSjW1
# R54PuQI5OffkyyVIiRTMLJR9MYIEDTCCBAkCAQEwgZMwfDELMAkGA1UEBhMCVVMx
# EzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoT
# FU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUt
# U3RhbXAgUENBIDIwMTACEzMAAAG59gANZVRPvAMAAQAAAbkwDQYJYIZIAWUDBAIB
# BQCgggFKMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAvBgkqhkiG9w0BCQQx
# IgQgdCdXmRNXQAHjxT5PFITFrUxnR5FVGn0Jlrvgtn885+0wgfoGCyqGSIb3DQEJ
# EAIvMYHqMIHnMIHkMIG9BCBk60bO8W85uTAfJVEO3vX2aLaQFcgcGpdwsOoi+foP
# 9DCBmDCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAw
# DgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24x
# JjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwAhMzAAABufYA
# DWVUT7wDAAEAAAG5MCIEIHZkfzkg8/t0h5bYPnx+dUidlymKgBswemOZMDQby4gO
# MA0GCSqGSIb3DQEBCwUABIICAJLbeG1dpXqQ4pJFMqAqPaMoSfT2+27qWpNI7Yiw
# eA73SPFB4oev9BZgsjGsOP7SypHVH7k+ASwwhyxf2fNfUdg3upD7L4iYVpLYxNJa
# gsHWoqrBTVw0h9GxV4HgYbhhaJA+hule5cS27NqvedP6VuqR0jwrRaRM0Yk/s96C
# L0ZiVZ8eqJF//9IK9DCEMwGUyVyUgBLeY74rSl2SFOKGhcplPCVzQeVqso9AfR5d
# JHHztOp14nLZNVmMiqJWHJd1S1D1S6+3aP0zXckltDX3b26YxwDXWkTZxlG9Iw4z
# eQeAC+tP3RBR2n7PAx0AXdsIjLLCs2FZsq18FJGFNmAd2XV7e4hlcFmr2GcpD82u
# sgicUueK8A3JvvwKNfEJhU/YSfux3O5ifontr6jrcuywSFHHOusL0pe6XD7pVexV
# 31vMbApaJl+J4WM7SCxQ73i9LTiFv/YGzUGx1jY668aLfFHTqBQHsENMmC3rrnnY
# KRBoumx76yOPT+ehMz8ADh1Gd65mlSsHc5/9S6np99Ih9YPqQZei7OwtZSMZ3iQq
# EY5AplqD1bk9L4V2fbGt0+ruUVVipIX3y48nlqk6LVvEm5HM7B2lZITxMoqvJi53
# yG1QWd7Jh9JGowqT7wWKmfNQ6hpQi6ET4XNZ6Q9tl5NL3UCGdGAW4NTW2U0TGQUF
# YLiw
# SIG # End signature block