ORCA

2.0

Checks/check-ORCA118_2.ps1

                                using module "..\ORCA.psm1"

class ORCA118_2 : ORCACheck

{

    <#

        CONSTRUCTOR with Check Header Data

    #>

    ORCA118_2()

    {

        $this.Control="118-2"

        $this.Area="Transport Rules"

        $this.Name="Domain Whitelisting"

        $this.PassText="Domains are not being whitelisted in an unsafe manner"

        $this.FailRecommendation="Remove whitelisting on domains"

        $this.Importance="Emails coming from whitelisted domains bypass several layers of protection within Exchange Online Protection. If domains are whitelisted, they are open to being spoofed from malicious actors."

        $this.ExpandResults=$True

        $this.CheckType=[CheckType]::ObjectPropertyValue

        $this.ObjectType="Transport Rule"

        $this.ItemName="Condition"

        $this.DataType="Whitelisted Address"

        $this.ChiValue=[ORCACHI]::High

        $this.Links= @{

            "Exchange admin center in Exchange Online"="https://outlook.office365.com/ecp/"

            "Using Exchange Transport Rules (ETRs) to allow specific senders"="https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/create-safe-sender-lists-in-office-365#using-exchange-transport-rules-etrs-to-allow-specific-senders-recommended"

        }

    }

    <#

        RESULTS

    #>

    GetResults($Config)

    {

        $Check = "Transport Rule SCL"

        # Look through Transport Rule for an action SetSCL -1

        ForEach($TransportRule in $Config["TransportRules"]) 

        {

            If($TransportRule.SetSCL -eq "-1") 

            {

                #Rules that apply to the sender domain

                #From Address notmatch is to include if just domain name is value

                If($TransportRule.SenderDomainIs -ne $null -or ($TransportRule.FromAddressContainsWords -ne $null -and $TransportRule.FromAddressContainsWords -notmatch ".+@") -or ($TransportRule.FromAddressMatchesPatterns -ne $null -and $TransportRule.FromAddressMatchesPatterns -notmatch ".+@"))

                {

                    #Look for condition that checks auth results header and its value

                    If(($TransportRule.HeaderContainsMessageHeader -eq 'Authentication-Results' -and $TransportRule.HeaderContainsWords -ne $null) -or ($TransportRule.HeaderMatchesMessageHeader -like '*Authentication-Results*' -and $TransportRule.HeaderMatchesPatterns -ne $null)) 

                    {

                        # OK

                    }

                    #Look for exception that checks auth results header and its value 

                    elseif(($TransportRule.ExceptIfHeaderContainsMessageHeader -eq 'Authentication-Results' -and $TransportRule.ExceptIfHeaderContainsWords -ne $null) -or ($TransportRule.ExceptIfHeaderMatchesMessageHeader -like '*Authentication-Results*' -and $TransportRule.ExceptIfHeaderMatchesPatterns -ne $null)) 

                    {

                        # OK

                    }

                    elseif($TransportRule.SenderIpRanges -ne $null) 

                    {

                        # OK

                    }

                    #Look for condition that checks for any other header and its value

                    else 

                    {

                        ForEach($RuleDomain in $($TransportRule.SenderDomainIs)) 

                        {

                            # Check objects

                            $ConfigObject = [ORCACheckConfig]::new()

                            $ConfigObject.Object=$($TransportRule.Name)

                            $ConfigObject.ConfigItem="From Domain"

                            $ConfigObject.ConfigData=$($RuleDomain)

                            if($TransportRule.State -eq "Disabled")

                            {

                                $ConfigObject.InfoText = "This rule is marked as disabled, while this rule will not apply, it is being flagged incase of accidental enablement."

                                $ConfigObject.SetResult([ORCAConfigLevel]::Informational,"Fail")

                            }

                            else 

                            {

                                $ConfigObject.SetResult([ORCAConfigLevel]::Standard,"Fail")

                            }

                            $this.AddConfig($ConfigObject)  

                        }

                        ForEach($FromAddressContains in $($TransportRule.FromAddressContainsWords)) 

                        {

                            # Check objects

                            $ConfigObject = [ORCACheckConfig]::new()

                            $ConfigObject.Object=$($TransportRule.Name)

                            $ConfigObject.ConfigItem="From Contains"

                            $ConfigObject."$($FromAddressContains)"

                            if($TransportRule.State -eq "Disabled")

                            {

                                $ConfigObject.InfoText = "This rule is marked as disabled, while this rule will not apply, it is being flagged incase of accidental enablement."

                                $ConfigObject.SetResult([ORCAConfigLevel]::Informational,"Fail")

                            }

                            else 

                            {

                                $ConfigObject.SetResult([ORCAConfigLevel]::Standard,"Fail")

                            }

                            $this.AddConfig($ConfigObject)  

                        }

                        ForEach($FromAddressMatch in $($TransportRule.FromAddressMatchesPatterns)) 

                        {

                            # Check objects

                            $ConfigObject = [ORCACheckConfig]::new()

                            $ConfigObject.Object=$($TransportRule.Name)

                            $ConfigObject.ConfigItem="From Matches"

                            $ConfigObject."$($FromAddressMatch)"

                            if($TransportRule.State -eq "Disabled")

                            {

                                $ConfigObject.InfoText = "This rule is marked as disabled, while this rule will not apply, it is being flagged incase of accidental enablement."

                                $ConfigObject.SetResult([ORCAConfigLevel]::Informational,"Fail")

                            }

                            else 

                            {

                                $ConfigObject.SetResult([ORCAConfigLevel]::Standard,"Fail")

                            }

                            $this.AddConfig($ConfigObject) 

                        }

                    }

                }

                #No sender domain restriction, so check for IP restriction

                elseif($null -ne $TransportRule.SenderIpRanges) 

                {

                    ForEach($SenderIpRange in $TransportRule.SenderIpRanges) 

                    {

                        # Check objects

                        $ConfigObject = [ORCACheckConfig]::new()

                        $ConfigObject.Object=$($TransportRule.Name)

                        $ConfigObject.ConfigItem="IP Range"

                        $ConfigObject.ConfigData=$SenderIpRange

                        if($TransportRule.State -eq "Disabled")

                        {

                            $ConfigObject.InfoText = "This rule is marked as disabled, while this rule will not apply, it is being flagged incase of accidental enablement."

                            $ConfigObject.SetResult([ORCAConfigLevel]::Informational,"Fail")

                        }

                        else 

                        {

                            $ConfigObject.SetResult([ORCAConfigLevel]::Standard,"Fail")

                        }

                        $this.AddConfig($ConfigObject) 

                    }

                }

                #No sender restriction, so check for condition that checks auth results header and its value

                elseif(($TransportRule.HeaderContainsMessageHeader -eq 'Authentication-Results' -and $TransportRule.HeaderContainsWords -ne $null) -or ($TransportRule.HeaderMatchesMessageHeader -like '*Authentication-Results*' -and $TransportRule.HeaderMatchesPatterns -ne $null)) 

                {

                    # OK

                }

                #No sender restriction, so check for exception that checks auth results header and its value 

                elseif(($TransportRule.ExceptIfHeaderContainsMessageHeader -eq 'Authentication-Results' -and $TransportRule.ExceptIfHeaderContainsWords -ne $null) -or ($TransportRule.ExceptIfHeaderMatchesMessageHeader -like '*Authentication-Results*' -and $TransportRule.ExceptIfHeaderMatchesPatterns -ne $null)) 

                {

                    # OK

                }

            }

        }    

    }

}

# SIG # Begin signature block

# MIIlyQYJKoZIhvcNAQcCoIIlujCCJbYCAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCoR5dtyTetF6Ww

# oHIOTQi1r5hYaYb631SKQdxUqR6O96CCC6EwggUGMIID7qADAgECAhMzAAAE4xrK

# 0/aegtm7AAEAAATjMA0GCSqGSIb3DQEBCwUAMHkxCzAJBgNVBAYTAlVTMRMwEQYD

# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy

# b3NvZnQgQ29ycG9yYXRpb24xIzAhBgNVBAMTGk1pY3Jvc29mdCBUZXN0aW5nIFBD

# QSAyMDEwMB4XDTIxMDkwMjE5MjYyOFoXDTIyMDkwMTE5MjYyOFowfDELMAkGA1UE

# BhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAc

# BgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdQ29kZSBTaWdu

# IFRlc3QgKERPIE5PVCBUUlVTVCkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK

# AoIBAQDokaNBqvPFgH8yAnEicnWyLoQ58nf7j+B20b5uqsDq9EXWyt87+Wc9CCFh

# +9gxWx6wx+iRsO/yT8SZhxi/w00uxM5jDWnbAbSIMB2VrNnLGNOxAQj674zPskBs

# ecseXAMHA/+o5ujZOse4EorLmTfJ5f/Zzun8KVVwlSd1CVlj0hgk28xmTdLV7ZWw

# 0wV9e/0p/XOHSRUNWw8gFfIfzli3oVV4H/DzT2o1jD4HIt3QIX1kRRXVqleASUgD

# Z6/6JthrKti4xfyMdSUGyXuxEoe6zZ4EOXltaHw7hqZzH2Ufl3UxB6HmdxvG9BI4

# 3LVKq3pFO+Nj3NdMVkyptnjDJnGpAgMBAAGjggGCMIIBfjATBgNVHSUEDDAKBggr

# BgEFBQcDAzAdBgNVHQ4EFgQUPMsdBtvwLsgDf0B50WrJSL+NYrEwUAYDVR0RBEkw

# R6RFMEMxKTAnBgNVBAsTIE1pY3Jvc29mdCBPcGVyYXRpb25zIFB1ZXJ0byBSaWNv

# MRYwFAYDVQQFEw0yMzAwNzIrNDY3NjA2MB8GA1UdIwQYMBaAFL9loqtvdaNORZZX

# Bc85h/TAFRwcMFwGA1UdHwRVMFMwUaBPoE2GS2h0dHA6Ly93d3cubWljcm9zb2Z0

# LmNvbS9wa2lvcHMvY3JsL01pY3Jvc29mdCUyMFRlc3RpbmclMjBQQ0ElMjAyMDEw

# KDEpLmNybDBpBggrBgEFBQcBAQRdMFswWQYIKwYBBQUHMAKGTWh0dHA6Ly93d3cu

# bWljcm9zb2Z0LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwVGVzdGluZyUy

# MFBDQSUyMDIwMTAoMSkuY3J0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQAD

# ggEBAAylFduuUCCNS+ejRtNeqm7geSoNzl+E0wbGZi4W9+rqo972KaS338FB5Y5G

# 8PNqaN3RNqNaHra/zI97JaLYjrZ+iCmKMzROdVS5cR/WpAla36J/tpuVSvNwwvW1

# 5KHRv6PEzGQ7BQYU55cMTkUwNtRVbARMdjcFa3pbuIkioVsoFNVOZ4e8aOSPV+Vz

# PVmOU2xltmM/8IOgTSfFTCJhqY7d/vjqajXAXg2olbbJ2vX051uUuFfIyfo/5xJS

# uyWOUCZ1opzXHy5EwrkmdZs6orQtMy1akT6UYjl4x5VZsqiszDshDNjVgRUdR97M

# d7NxQZEScdZfoTf0byI8Cwtp8JIwggaTMIIEe6ADAgECAhMzAAAALTV6RojJB3HY

# AAAAAAAtMA0GCSqGSIb3DQEBCwUAMIGQMQswCQYDVQQGEwJVUzETMBEGA1UECBMK

# V2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0

# IENvcnBvcmF0aW9uMTowOAYDVQQDEzFNaWNyb3NvZnQgVGVzdGluZyBSb290IENl

# cnRpZmljYXRlIEF1dGhvcml0eSAyMDEwMB4XDTIwMTIxMDIwNDMyMFoXDTM1MDYx

# NzIxMDQxMVoweTELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAO

# BgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEj

# MCEGA1UEAxMaTWljcm9zb2Z0IFRlc3RpbmcgUENBIDIwMTAwggEiMA0GCSqGSIb3

# DQEBAQUAA4IBDwAwggEKAoIBAQC/PGCBq77s/9cXY/KmQtETYpywF866Rhp7Ii5V

# c5pUucbU0cqY/ndHDY6d8F7M+FTv8s8q1GLxqTQKBNfFBYbyEPVN05YIZoXbAn0Y

# 3OJ6I6eaKV2ueRjPDGPwGv+BqalDP6kLuVHxs0g6/EQuXxHFVjr/yg7NiAjB/cfV

# 9T7v6k4bcosjvUU3nh9wwafJuCBz7fNsPYshBc93Ev6h3AfpDVt4CWwyVRBH0DfI

# x/f6c/5GNORWFqg3ZFPWNfvDgLaOtoaRoRDWwUr243rUEQqy3i6eEJfgga4SXYgB

# XcykxChSnGDwCuaIr0vpV4rsow83Hin2XSHT19pdDslO241tAgMBAAGjggH6MIIB

# 9jAOBgNVHQ8BAf8EBAMCAYYwEgYJKwYBBAGCNxUBBAUCAwEAATAjBgkrBgEEAYI3

# FQIEFgQU6p9fM7bQX56t6y2mwQK7QDjL57UwHQYDVR0OBBYEFL9loqtvdaNORZZX

# Bc85h/TAFRwcMFQGA1UdIARNMEswSQYEVR0gADBBMD8GCCsGAQUFBwIBFjNodHRw

# Oi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL0RvY3MvUmVwb3NpdG9yeS5odG0w

# GQYJKwYBBAGCNxQCBAweCgBTAHUAYgBDAEEwDwYDVR0TAQH/BAUwAwEB/zAfBgNV

# HSMEGDAWgBSjAQR+MIgz67kxnMrrhXZn/GW00TBZBgNVHR8EUjBQME6gTKBKhkho

# dHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNUZXNS

# b29DZXJBdXRfMjAxMC0wNi0xNy5jcmwwgY0GCCsGAQUFBwEBBIGAMH4wTQYIKwYB

# BQUHMAKGQWh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljVGVz

# Um9vQ2VyQXV0XzIwMTAtMDYtMTcuY3J0MC0GCCsGAQUFBzABhiFodHRwOi8vb25l

# b2NzcC5taWNyb3NvZnQuY29tL29jc3AwDQYJKoZIhvcNAQELBQADggIBACe00IWy

# nswPpCpTc9Vt2tcxAMj2/2PI9gERtRiS2ty0+a8m6PxKeb3BZ7CIA3llzzU1BViO

# 4oMGlvW6fhJZUJvg8NU9nQnzu0bNh7104nfQRgZ6IhppK2QsuYs5gAzqgiciojBX

# IiTZIT+raUa3w6/Bxl682Y+RViOTqfImLkR29LpyI9GZb1tFZFPilZTxtkhAv3fw

# sTiUc5ACLGsBCJZ6zlLOnZTzkTSct1oOvnD8jbwn9nX7jNbU1qjWmtUI6quiyeg1

# R9V/WS+zB9bcVjaXU+IBinywbI7nsZrO1d0GgQ4FwMt519w+tr340t0QXfo2QTSD

# 711uiQVjsrGFQnxakyIKY3jKP0soUu9Bty0Ywklj0TAcWJ+bamBqJpp8oXUbLP42

# u4nMQSCnKwyj9/0BUFD+oJ09BAYRandAMhp5/i2z1BPH5GYMoIEMxMUuAWaaFu1R

# jQlaMuQqfuyjP8shwNSV7+nlOIUPhWF9mcBy9hAdd+6yWfKn7K6FbMBKcBA2c4g7

# p9zUkUjCQORwz6T9Oyl8BqPMeihIDBeSs5auNENXrAjRjMxUesTJDSFnk2chdsve

# WtOQ4+N/c0G7WdpI0RrJJ25K0NsVWNXdNegQ0SdmK6AkphLCaHOhgczWeCKk3ms1

# 2omIrm6SnoTwsPOLeXn/tdy0lBjf5mAcMmiyMYIZfjCCGXoCAQEwgZAweTELMAkG

# A1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQx

# HjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEjMCEGA1UEAxMaTWljcm9z

# b2Z0IFRlc3RpbmcgUENBIDIwMTACEzMAAATjGsrT9p6C2bsAAQAABOMwDQYJYIZI

# AWUDBAIBBQCggbAwGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGC

# NwIBCzEOMAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIAy3NXLB2gs+k6J5

# ZE7dmFOwkFetogbFrfeE+gITFs9IMEQGCisGAQQBgjcCAQwxNjA0oBSAEgBNAGkA

# YwByAG8AcwBvAGYAdKEcgBpodHRwczovL3d3dy5taWNyb3NvZnQuY29tIDANBgkq

# hkiG9w0BAQEFAASCAQC9FgrJGj2KaB8uJn7zxS5RDaR/VU662KVi+sCZWdc4Nfdv

# m7TRxoVscoJLOm7OL/PsNXMS5SAmwkerb5iw9YaMhFRlys3HxwxZMEv4EesM6puU

# KJ2oeoVdKk6o8A94xvCpNmPZFXbjuXJCwoDTMV22T8LE1N7HanDuQR4PugatRmx7

# ldKgvzPVE4FbcCy4bbfm9pZwwcUxC7ik5PuYCAg4ydZ6YX1QLPffmk+2gZhSSLTP

# PNbYREo52gRCaplqVdJESPrcdzFzeZzhhSrKK4qlFfPE/Xg2av/DMYyABN6jhK1K

# eLh9QLXM/VEkR4dhH1MprejGjFr/pyLgvIa4bXtloYIXCzCCFwcGCisGAQQBgjcD

# AwExghb3MIIW8wYJKoZIhvcNAQcCoIIW5DCCFuACAQMxDzANBglghkgBZQMEAgEF

# ADCCAVQGCyqGSIb3DQEJEAEEoIIBQwSCAT8wggE7AgEBBgorBgEEAYRZCgMBMDEw

# DQYJYIZIAWUDBAIBBQAEIOBLijyjb2i2qrGd3T6FdmGnVXKP+W8xKMfVZbsw0btq

# AgZiL9jjR7sYEjIwMjIwNDAxMDQwNzM3LjkxWjAEgAIB9KCB1KSB0TCBzjELMAkG

# A1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQx

# HjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEpMCcGA1UECxMgTWljcm9z

# b2Z0IE9wZXJhdGlvbnMgUHVlcnRvIFJpY28xJjAkBgNVBAsTHVRoYWxlcyBUU1Mg

# RVNOOkQ5REUtRTM5QS00M0ZFMSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1TdGFt

# cCBTZXJ2aWNloIIRXzCCBxAwggT4oAMCAQICEzMAAAGsZryHIl3ePXsAAQAAAaww

# DQYJKoZIhvcNAQELBQAwfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0

# b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3Jh

# dGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwHhcN

# MjIwMzAyMTg1MTI5WhcNMjMwNTExMTg1MTI5WjCBzjELMAkGA1UEBhMCVVMxEzAR

# BgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1p

# Y3Jvc29mdCBDb3Jwb3JhdGlvbjEpMCcGA1UECxMgTWljcm9zb2Z0IE9wZXJhdGlv

# bnMgUHVlcnRvIFJpY28xJjAkBgNVBAsTHVRoYWxlcyBUU1MgRVNOOkQ5REUtRTM5

# QS00M0ZFMSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNlMIIC

# IjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAx3gLUMUXYu7HccwrwASUx1MX

# iIb1E7IpBYV6FNd74RfVA6tMEWeEwAo0chBajGQrVbrb+hBBCa0gejyymEy3VamQ

# s28Kbctryx1Uve38EDHtRaSZ++6MncoNpKC3dyVzm409SPt7fZTif8Sn2g5z4+/8

# QdztcYfV8ZG8tFjPCjE/XGQqV66xsjNP9oqfpYLYGCA/OMdeKf0oTuSuIK6oD4k2

# GySR51MclAii1uVH6tlyx7FNKaM75ntHSZ94eJTwOe29m9n/1p31dSEPBQkUpnxl

# m/GeqdlfAViQMo1qBjyDToEXW8O6VuUCzoDiG4/V7um0oWmkHVVmQtQCYhbXHEka

# zeR6J0BNYhXHbawZXJ6ZpPb01+0On+NGwPD9qHC/U2S/pa/KSi8rSQM8hj1MJb1x

# Fu9R4SWT74JUztwiquXxBjeaARDyiLjlXMQFe5jThjUqKNsYthEU1TKlcxEMClX6

# RyMby5JPXeZIJ/aIyFZFEvP3+PIjB7uWZfPjNTJhySv7Y2bwatKrl9UA+yEg7wBv

# 9o6jr+h7cbdj5yKXyLJEksk3FsxjGJAkpm9vGUIin6kYidoPXfvczso88X/Jd5Pi

# EbQupcq96WSC2WnN58+uZRW6mNhOB4Z+6lTAXPKZKTglE07W2FEHRsMoMjI0xWoS

# 69XVTF1yuJxXSiOB4kcCAwEAAaOCATYwggEyMB0GA1UdDgQWBBRYEZ93BMsfQGdK

# PHxJWphawECOTTAfBgNVHSMEGDAWgBSfpxVdAF5iXYP05dJlpxtTNRnpcjBfBgNV

# HR8EWDBWMFSgUqBQhk5odHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2Ny

# bC9NaWNyb3NvZnQlMjBUaW1lLVN0YW1wJTIwUENBJTIwMjAxMCgxKS5jcmwwbAYI

# KwYBBQUHAQEEYDBeMFwGCCsGAQUFBzAChlBodHRwOi8vd3d3Lm1pY3Jvc29mdC5j

# b20vcGtpb3BzL2NlcnRzL01pY3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAy

# MDEwKDEpLmNydDAMBgNVHRMBAf8EAjAAMBMGA1UdJQQMMAoGCCsGAQUFBwMIMA0G

# CSqGSIb3DQEBCwUAA4ICAQB50LUCWFVccKV2Ty2gjMBb1DIhNxF7KFSmzW4PrvMI

# LfTx9HNgURL/a8xfujQ5smDMLFPWeLS+RyzxYbYxQiyT3VEI8h4PNNAi0imP1lPP

# 2HS259woabdqGSdGzWGhXXaNEWRxqpcmjV+zK6gqAP4VNPaU6+sSw2MmHnASyL48

# H+ZWaH8lrRW7yOFQlzWGsFRDliKxDg3TSydnCE6gJ49dt0PocazVyaxdluuRPy80

# 9hXwucjiXG4n9hphLbSpCvpj0MgcUM1jFltOWxB5ez8qOeFE10WIIagBwsdbB5Z5

# GzOHaJSEx9jX/v13uyiZ+PHpnIk9k6vh8TRRPaX+sFoFOug+kM6+lo6xjoT+14ss

# x/KevpQ5B4TiVGLDn2yJUbIAaqlMFNt3MAUsEUfjS5uvtUSV2aOIdrXgSRnFi9yD

# MrEqq5vjKspp+j+P1pRvAusvZUwdZylrXwmG/rMiN3TUgaRR2PdQn4kpA0DPl7I/

# JBJk+33CzxvKeh0aUzmdiQcHLus++PjnL5nPuOsuCOC9kiLEazPCorIonjsA8fGs

# fwaMJC6xu9b00XgsBgqhlkaPs/CZAD5ebAPm19RDQq7MxEWYyk5TO2JMCAmNB/1M

# y5zeliakVYSvySxh3CuOt1ZgAsJcD8hBcR0CKxDCPljNOyHhDFNSr69FLGz3fIHe

# cjCCB3EwggVZoAMCAQICEzMAAAAVxedrngKbSZkAAAAAABUwDQYJKoZIhvcNAQEL

# BQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQH

# EwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xMjAwBgNV

# BAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDEwMB4X

# DTIxMDkzMDE4MjIyNVoXDTMwMDkzMDE4MzIyNVowfDELMAkGA1UEBhMCVVMxEzAR

# BgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1p

# Y3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRpbWUtU3Rh

# bXAgUENBIDIwMTAwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDk4aZM

# 57RyIQt5osvXJHm9DtWC0/3unAcH0qlsTnXIyjVX9gF/bErg4r25PhdgM/9cT8dm

# 95VTcVrifkpa/rg2Z4VGIwy1jRPPdzLAEBjoYH1qUoNEt6aORmsHFPPFdvWGUNzB

# RMhxXFExN6AKOG6N7dcP2CZTfDlhAnrEqv1yaa8dq6z2Nr41JmTamDu6GnszrYBb

# fowQHJ1S/rboYiXcag/PXfT+jlPP1uyFVk3v3byNpOORj7I5LFGc6XBpDco2LXCO

# Mcg1KL3jtIckw+DJj361VI/c+gVVmG1oO5pGve2krnopN6zL64NF50ZuyjLVwIYw

# XE8s4mKyzbnijYjklqwBSru+cakXW2dg3viSkR4dPf0gz3N9QZpGdc3EXzTdEonW

# /aUgfX782Z5F37ZyL9t9X4C626p+Nuw2TPYrbqgSUei/BQOj0XOmTTd0lBw0gg/w

# EPK3Rxjtp+iZfD9M269ewvPV2HM9Q07BMzlMjgK8QmguEOqEUUbi0b1qGFphAXPK

# Z6Je1yh2AuIzGHLXpyDwwvoSCtdjbwzJNmSLW6CmgyFdXzB0kZSU2LlQ+QuJYfM2

# BjUYhEfb3BvR/bLUHMVr9lxSUV0S2yW6r1AFemzFER1y7435UsSFF5PAPBXbGjfH

# CBUYP3irRbb1Hode2o+eFnJpxq57t7c+auIurQIDAQABo4IB3TCCAdkwEgYJKwYB

# BAGCNxUBBAUCAwEAATAjBgkrBgEEAYI3FQIEFgQUKqdS/mTEmr6CkTxGNSnPEP8v

# BO4wHQYDVR0OBBYEFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMFwGA1UdIARVMFMwUQYM

# KwYBBAGCN0yDfQEBMEEwPwYIKwYBBQUHAgEWM2h0dHA6Ly93d3cubWljcm9zb2Z0

# LmNvbS9wa2lvcHMvRG9jcy9SZXBvc2l0b3J5Lmh0bTATBgNVHSUEDDAKBggrBgEF

# BQcDCDAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYD

# VR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTV9lbLj+iiXGJo0T2UkFvXzpoYxDBW

# BgNVHR8ETzBNMEugSaBHhkVodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2Ny

# bC9wcm9kdWN0cy9NaWNSb29DZXJBdXRfMjAxMC0wNi0yMy5jcmwwWgYIKwYBBQUH

# AQEETjBMMEoGCCsGAQUFBzAChj5odHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtp

# L2NlcnRzL01pY1Jvb0NlckF1dF8yMDEwLTA2LTIzLmNydDANBgkqhkiG9w0BAQsF

# AAOCAgEAnVV9/Cqt4SwfZwExJFvhnnJL/Klv6lwUtj5OR2R4sQaTlz0xM7U518Jx

# Nj/aZGx80HU5bbsPMeTCj/ts0aGUGCLu6WZnOlNN3Zi6th542DYunKmCVgADsAW+

# iehp4LoJ7nvfam++Kctu2D9IdQHZGN5tggz1bSNU5HhTdSRXud2f8449xvNo32X2

# pFaq95W2KFUn0CS9QKC/GbYSEhFdPSfgQJY4rPf5KYnDvBewVIVCs/wMnosZiefw

# C2qBwoEZQhlSdYo2wh3DYXMuLGt7bj8sCXgU6ZGyqVvfSaN0DLzskYDSPeZKPmY7

# T7uG+jIa2Zb0j/aRAfbOxnT99kxybxCrdTDFNLB62FD+CljdQDzHVG2dY3RILLFO

# Ry3BFARxv2T5JL5zbcqOCb2zAVdJVGTZc9d/HltEAY5aGZFrDZ+kKNxnGSgkujhL

# mm77IVRrakURR6nxt67I6IleT53S0Ex2tVdUCbFpAUR+fKFhbHP+CrvsQWY9af3L

# wUFJfn6Tvsv4O+S3Fb+0zj6lMVGEvL8CwYKiexcdFYmNcP7ntdAoGokLjzbaukz5

# m/8K6TT4JDVnK+ANuOaMmdbhIurwJ0I9JZTmdHRbatGePu1+oDEzfbzL6Xu/OHBE

# 0ZDxyKs6ijoIYn/ZcGNTTY3ugm2lBRDBcQZqELQdVTNYs6FwZvKhggLSMIICOwIB

# ATCB/KGB1KSB0TCBzjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24x

# EDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlv

# bjEpMCcGA1UECxMgTWljcm9zb2Z0IE9wZXJhdGlvbnMgUHVlcnRvIFJpY28xJjAk

# BgNVBAsTHVRoYWxlcyBUU1MgRVNOOkQ5REUtRTM5QS00M0ZFMSUwIwYDVQQDExxN

# aWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNloiMKAQEwBwYFKw4DAhoDFQCxGtIT

# sLiwSf3oAyGM2RdnRjWKoKCBgzCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQI

# EwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3Nv

# ZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBD

# QSAyMDEwMA0GCSqGSIb3DQEBBQUAAgUA5fDAtTAiGA8yMDIyMDQwMTA0MDcxN1oY

# DzIwMjIwNDAyMDQwNzE3WjB3MD0GCisGAQQBhFkKBAExLzAtMAoCBQDl8MC1AgEA

# MAoCAQACAg3/AgH/MAcCAQACAhEqMAoCBQDl8hI1AgEAMDYGCisGAQQBhFkKBAIx

# KDAmMAwGCisGAQQBhFkKAwKgCjAIAgEAAgMHoSChCjAIAgEAAgMBhqAwDQYJKoZI

# hvcNAQEFBQADgYEAIFotuKJOP71cVy8Xg+eF1viePzWi5P7WA5UvbE4AH3aWQTrl

# radL4ndVkva+JXl8BpEPZTLu4FRYba6eMMFYQzv3M8tF6+u0AFYpoKKLHR5Hdp7J

# 68YVm2gCLYFNUGTlUi/kUnHTx5ENNfbKaAFM3pMrhxxBkk5F+e3kcbicH0YxggQN

# MIIECQIBATCBkzB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQ

# MA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9u

# MSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMAITMwAAAaxm

# vIciXd49ewABAAABrDANBglghkgBZQMEAgEFAKCCAUowGgYJKoZIhvcNAQkDMQ0G

# CyqGSIb3DQEJEAEEMC8GCSqGSIb3DQEJBDEiBCBaGKcrCTgctyH0m26LVJ3x+6bm

# 9YoTWdzvgOju3QtoRjCB+gYLKoZIhvcNAQkQAi8xgeowgecwgeQwgb0EIPm3AZKD

# OC8JcQBytXPnqbv0+n5tAl/7T4uDZ9oELML1MIGYMIGApH4wfDELMAkGA1UEBhMC

# VVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNV

# BAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0IFRp

# bWUtU3RhbXAgUENBIDIwMTACEzMAAAGsZryHIl3ePXsAAQAAAawwIgQg5Cpn6FgQ

# FsclPW2Q/OnBGS/bh/FMuBbqhCaWLdpfip4wDQYJKoZIhvcNAQELBQAEggIAqRmu

# NmpYCVN0e0qjtqGPzsf40YPerOMAz73DNNgi2rKx72ThScbo0l6gfrXCZ48VDesJ

# 9Mf5yYasbbPJJ/OIOmwoCs+ty4mJ5jBUTRxzHLvn7wfpALK8iHE6nVP/+7sbkUCC

# pV6DIO9samYpm0bNpF6REh+7goACHEYL9ODsnixhXzphPtw/qBa/a4SnpCIhsnff

# w5hUHt59OtxgquzntjiF0nL5tNNgWO8DGIciGyNdAaMORAWMzRUJL8PE3XlYTXKQ

# aLaM6+l6bbwIBNjiwHCD2nAKRuZW147sSEeM/LgGacA+8bGHAnrdr07vF9ymoixh

# PrPkc3+wMcgm2wjcFDch3ItSpNiediqx0yLNhU8XoUBYuztYCehBCaHLv2KXTTAC

# DOKfThDOsTrwmrsjiRJtLk6JTM4TlxtL7MxHUJWqNpTLUKNnX78uliL5ASnz24lh

# XlZtOTdjmNVnqAVl3vdDa0k9ewNgH5NoosfQbppgSo9yWEc/2v93kcCY5cYONq6D

# F8BzesdeU/r+mDQeGakXHoYv3FCGZHLIqVx9NgynE1FpKG9QTmUR8wv3+BG67U0W

# rZlXjZbxPXEed2DGW3YvCm0Nb8TkdjnLsBZvyq4wHzZjwK8I4xdnfBzj/ILHSnpk

# e+Fvi1pkBRYpI7XWekLqpz8+0cbIEb6Yb/UmEmU=

# SIG # End signature block