SVT/SVT.ps1

Set-StrictMode -Version Latest

function Get-AzSKADOSecurityStatus
{
    <#
    .SYNOPSIS
    This command would help in validating the security controls for the Azure resources meeting the specified input criteria.
    .DESCRIPTION
    This command will execute the security controls and will validate their status as 'Success' or 'Failure' based on the security guidance. Refer https://aka.ms/azskossdocs for more information
 
    .PARAMETER OrganizationName
        Organization name for which the security evaluation has to be performed.
 
    .PARAMETER ProjectNames
        Project name for which the security evaluation has to be performed.
 
    .PARAMETER BuildNames
        Build name for which the security evaluation has to be performed.
 
    .PARAMETER ReleaseNames
        Release name for which the security evaluation has to be performed.
 
    .PARAMETER AgentPoolNames
       Agent name for which the security evaluation has to be performed.
 
    .PARAMETER DetailedScan
        Print detailed scan logs for controls.
 
    .NOTES
    This command helps the application team to verify whether their Azure resources are compliant with the security guidance or not
 
    .LINK
    https://aka.ms/azskossdocs
 
    #>


    [OutputType([String])]
    [Alias("Get-AzSKAzureDevOpsSecurityStatus")]
    Param
    (

        [string]
        [Parameter(Position = 0, Mandatory = $true, HelpMessage="OrganizationName for which the security evaluation has to be performed.")]
        [ValidateNotNullOrEmpty()]
        [Alias("oz")]
        $OrganizationName,

        [string]
        [Parameter( HelpMessage="Project names for which the security evaluation has to be performed.")]
        [ValidateNotNullOrEmpty()]
        [Alias("pns", "ProjectName", "pn")]
        $ProjectNames,

        [string]
        [Parameter(HelpMessage="Build names for which the security evaluation has to be performed.")]
        [ValidateNotNullOrEmpty()]
        [Alias("bns", "BuildName","bn")]
        $BuildNames,

        [string]
        [Parameter(HelpMessage="Release names for which the security evaluation has to be performed.")]
        [ValidateNotNullOrEmpty()]
        [Alias("rns", "ReleaseName","rn")]
        $ReleaseNames,

        [string]
        [Parameter(HelpMessage="Agent Pool names for which the security evaluation has to be performed.")]
        [ValidateNotNullOrEmpty()]
        [Alias("aps", "AgentPoolName","ap")]
        $AgentPoolNames,


        [string]
        [Parameter(HelpMessage="Service connection names for which the security evaluation has to be performed.")]
        [ValidateNotNullOrEmpty()]
        [Alias("sc", "ServiceConnectionName", "scs")]
        $ServiceConnectionNames,

        [string]
        [Parameter(HelpMessage="Variable group names for which the security evaluation has to be performed.")]
        [ValidateNotNullOrEmpty()]
        [Alias("vg", "VariableGroupName", "vgs")]
        $VariableGroupNames,

        [string]
        [Parameter(HelpMessage="Repo name for which the security evaluation has to be perform.")]
        [ValidateNotNullOrEmpty()]
        [Alias("rpn", "RepoName","rp")]
        $RepoNames,

        [string]
        [Parameter(HelpMessage="Secure file name for which the security evaluation has to be perform.")]
        [ValidateNotNullOrEmpty()]
        [Alias("sfn", "SecureFileName","sf")]
        $SecureFileNames,

        [string]
        [Parameter(HelpMessage="Feed name for which the security evaluation has to be perform.")]
        [ValidateNotNullOrEmpty()]
        [Alias("fd", "FeedName","fdn")]
        $FeedNames,

        [string]
        [Parameter(HelpMessage="Environment name for which the security evaluation has to be perform.")]
        [ValidateNotNullOrEmpty()]
        [Alias("en", "EnvironmentName","env")]
        $EnvironmentNames,

        [switch]
        [Parameter(HelpMessage="Scan all supported resource types present under organization like build, release, projects etc.")]
        [Alias("sar", "saa" , "ScanAllArtifacts", "sat", "ScanAllResourceTypes")]
        $ScanAllResources,

        [string]
        [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage = "Comma separated control ids to filter the security controls. e.g.: ADO_Organization_AuthN_Use_AAD_Auth, ADO_Organization_SI_Review_InActive_Users etc.")]
        [Parameter(Mandatory = $true, ParameterSetName = "BulkAttestation", HelpMessage="Comma separated control ids to filter the security controls. e.g.: ADO_Organization_AuthN_Use_AAD_Auth, ADO_Organization_SI_Review_InActive_Users etc.")]
        [Parameter(Mandatory = $true, ParameterSetName = "BulkAttestationClear", HelpMessage="Comma separated control ids to filter the security controls. e.g.: ADO_Organization_AuthN_Use_AAD_Auth, ADO_Organization_SI_Review_InActive_Users etc.")]
        [Alias("BulkAttestControlId","cids","bacid")]
        [AllowEmptyString()]
        $ControlIds,

        [string]
        [Parameter(Mandatory = $false)]
        [Alias("ft")]
        $FilterTags,

        [string]
        [Parameter(Mandatory = $false)]
        [Alias("xt")]
        $ExcludeTags,

        [string]
        [Parameter(Mandatory = $false)]
        [Alias("xcids")]
        [AllowEmptyString()]
        $ExcludeControlIds,

        [switch]
        [Parameter(Mandatory = $false)]
        [Alias("ubc")]
        $UseBaselineControls,

        [switch]
        [Parameter(Mandatory = $false)]
        [Alias("upbc")]
        $UsePreviewBaselineControls,

        [string]
        [Parameter(Mandatory = $false, HelpMessage="Specify the severity of controls to be scanned. Example `"High, Medium`"")]
        [Alias("ControlSeverity")]
        $Severity,

        [int]
        [Parameter(Mandatory = $false, HelpMessage="Max # of objects to check. Default is 0 which means scan all.")]
        [Alias("mo")]
        $MaxObj = 0,

        [System.Security.SecureString]
        [Parameter(HelpMessage="Token to run scan in non-interactive mode")]
        [Alias("tk")]
        $PATToken,

        [switch]
        [Parameter(HelpMessage = "Switch to provide personal access token (PAT) using UI.")]
        [Alias("pfp")]
        $PromptForPAT,

        [string]
        [Parameter(Mandatory=$false, HelpMessage="KeyVault URL for PATToken")]
        [Alias("ptu")]
        $PATTokenURL,

        [ResourceTypeName]
        [Alias("rtn")]
        $ResourceTypeName = [ResourceTypeName]::All,

        [switch]
        [Parameter(Mandatory = $false)]
        [Alias("upc")]
        $UsePartialCommits,

        [switch]
        [Parameter(Mandatory = $false)]
        [Alias("dnrr")]
        $DoNotRefetchResources,

        [switch]
        [Parameter(Mandatory = $false)]
        [Alias("dnof")]
        $DoNotOpenOutputFolder,

        [ValidateSet("All","AlreadyAttested","NotAttested","None")]
        [Parameter(Mandatory = $false, ParameterSetName = "Default", HelpMessage="Using this switch, AzSK.ADO enters 'attest' mode immediately after a scan is completed. This ensures that attestation is done on the basis of the most current control statuses.")]
        [Parameter(Mandatory = $true, ParameterSetName = "BulkAttestation", HelpMessage="Using this switch, AzSK.ADO enters 'attest' mode immediately after a scan is completed. This ensures that attestation is done on the basis of the most current control statuses.")]
        [Parameter(Mandatory = $true, ParameterSetName = "BulkAttestationClear", HelpMessage="Using this switch, AzSK.ADO enters 'attest' mode immediately after a scan is completed. This ensures that attestation is done on the basis of the most current control statuses.")]
        [Alias("AttestControls","cta")]
        $ControlsToAttest = [AttestControls]::None,

        [switch]
        [Parameter(Mandatory = $true, ParameterSetName = "BulkAttestationClear", HelpMessage="Use this option if you want to clear the attestation for multiple resources in bulk, for a specified controlId.")]
        [Alias("bc")]
        $BulkClear,

        [string]
        [Parameter(Mandatory = $true, ParameterSetName = "BulkAttestation", HelpMessage="Use this option to provide an apt justification with proper business reason.")]
        [Alias("jt")]
        $JustificationText,

        [ValidateSet("NotAnIssue", "WillNotFix", "WillFixLater","NotApplicable","StateConfirmed","ApprovedException")]
        [Parameter(Mandatory = $true, ParameterSetName = "BulkAttestation", HelpMessage="Attester must select one of the attestation reasons (NotAnIssue, WillNotFix, WillFixLater, NotApplicable, StateConfirmed(if valid for the control))")]
        [Alias("as")]
        $AttestationStatus = [AttestationStatus]::None,

        [switch]
        [Parameter(Mandatory = $false, HelpMessage = "Switch to add approved exceptions.")]
        [Alias("aex")]
        $AddException,

        [Datetime]
        [Parameter(Mandatory = $false, HelpMessage = "Expiry date of approved exception.")]
        [Alias("aee")]
        $ApprovedExceptionExpiryDate,

        [string]
        [Parameter(Mandatory = $false, HelpMessage = "ID of approved exception.")]
        [Alias("aei")]
        $ApprovedExceptionID,

        [string]
        [Parameter(HelpMessage="Project name to store attestation details for organization-specific controls.")]
        [ValidateNotNullOrEmpty()]
        [Alias("atp","HostProjectName")]
        $AttestationHostProjectName,


        [ValidateSet("All","BaselineControls","PreviewBaselineControls", "Custom")]
        [Parameter(Mandatory = $false)]
        [Alias("abl")]
        [string] $AutoBugLog = [BugLogForControls]::All,


        [switch]
        [Parameter(HelpMessage = "Switch to auto-close bugs after the scan.")]
        [Alias("acb")]
        $AutoCloseBugs,

        [string]
        [Parameter(Mandatory=$false)]
        [Alias("apt")]
        $AreaPath,

        [string]
        [Parameter(Mandatory=$false)]
        [Alias("ipt")]
        $IterationPath,

        [string]
        [Parameter(Mandatory = $false, HelpMessage = "Specify the security severity of bugs to be logged.")]
        [Alias("ssv")]
        $SecuritySeverity,

        [string]
        [Parameter(HelpMessage="Specify the custom field reference name for bug description.")]
        [ValidateNotNullOrEmpty()]
        [Alias("bdf")]
        $BugDescriptionField,

        [switch]
        [Parameter(HelpMessage="Allow long running scan.")]
        [Alias("als", "alrs")]
        $AllowLongRunningScan,

        [string]
        [Parameter(Mandatory = $false, HelpMessage="Name of the project hosting organization policy with which the scan should run.")]
        [ValidateNotNullOrEmpty()]
        [Alias("pp")]
        $PolicyProject,

        [switch]
        [Parameter(HelpMessage="Print detailed scan logs for controls.")]
        [Alias("ds")]
        $DetailedScan,

        [string]
        [Parameter(HelpMessage="Service id for which the security evaluation has to be performed.")]
        [ValidateNotNullOrEmpty()]
        [Alias("svcid")]
        $ServiceIds,

        [switch]
        [Parameter(HelpMessage="Include admin controls (organization and project specific controls) in scan.")]
        [Alias("iac")]
        $IncludeAdminControls,

        [switch]
        [Parameter(HelpMessage="Skip organization and user controls.")]
        [Alias("souc")]
        $SkipOrgUserControls,

        [string]
        [Parameter(Mandatory = $false, HelpMessage="Name of the repository containing org policy endpoint.")]
        [ValidateNotNullOrEmpty()]
        [Alias("prn")]
        $PolicyRepoName,

        [ValidateSet("Graph", "RegEx", "GraphThenRegEx")]
        [Parameter(Mandatory = $false, HelpMessage="Evaluation method to evaluate SC-ALT admin controls.")]
        [Alias("acem")]
        [string] $ALTControlEvaluationMethod,
        
        [string]
        [Parameter(Mandatory = $false, HelpMessage="Folder path of builds to be scanned.")]
        [ValidateNotNullOrEmpty()]
        [Alias("bp")]
        $BuildsFolderPath,

        [string]
        [Parameter(Mandatory = $false, HelpMessage="Folder path of releases to be scanned.")]
        [ValidateNotNullOrEmpty()]
        [Alias("rfp")]
        $ReleasesFolderPath,

    
        [switch]
        [Parameter(HelpMessage="Print SARIF logs for the scan.")]
        [Alias("gsl")]
        $GenerateSarifLogs,

        [switch]
        [Parameter(HelpMessage="Switch to reset default logged in user.")]
        [Alias("rc")]
        $ResetCredentials,
        
        [switch]
        [Parameter(HelpMessage="Switch to copy current data object in local folder to facilitate control fix.")]
        [Alias("pcf")]
        $PrepareForControlFix,

        [switch]
        [Parameter(HelpMessage="Scan and generate backup of feeds on which current user has owner access for control fix.")]
        [Alias("coa")]
        $CheckOwnerAccess,

        [switch]
        [Parameter(Mandatory = $false, HelpMessage="Scan only those resource objects modified after immediately previous scan.")]
        [Alias("inc", "ScanIncrementally")]
        $IncrementalScan,

        [switch]
        [Parameter(Mandatory = $false, HelpMessage="Scan only those resource objects modified after immediately previous scan.")]
        [Alias("f")]
        $Force,

        [switch]
        [Parameter()]
        [Alias("bs")]
        $BatchScan,

        [switch]
        [switch]
        [Parameter()]
        [Alias("bsmp")]
        $BatchScanMultipleProjects,

        [string]
        [Parameter()]
        [Alias("fn")]
        $FolderName,

        [DateTime]
        [Parameter(Mandatory = $false, HelpMessage="Date to use as threshold for incremental scanning.")]
        [ValidateNotNullOrEmpty()]
        [Alias("dt", "IncrementDate")]
        $IncrementalDate,

        [switch]
        [Parameter(Mandatory = $false, HelpMessage="Scan attested resources during incremental scan")]
        [Alias("sars")]
        $ScanAttestedResources



    )
    Begin
    {
        [CommandHelper]::BeginCommand($PSCmdlet.MyInvocation);
        [ListenerHelper]::RegisterListeners();
    }

    Process
    {
        try
        {
            [ConfigurationHelper]::PolicyCacheContent = @()
            [ConfigurationHelper]::OnlinePolicyEnabled = $false
            [ConfigurationHelper]::OssPolicyUrl = ""
            [ConfigurationHelper]::OssPolicyEnabled = $false
            [ConfigurationHelper]::LocalPolicyEnabled = $false
            [ConfigurationHelper]::ConfigVersion = ""
            [AzSKSettings]::Instance = $null
            [AzSKConfig]::Instance = $null
            [ConfigurationHelper]::ServerConfigMetadata = $null
            [ControlHelper]::IsGroupDetailsFetchedFromPolicy = $false
            [ControlHelper]::CloudmineDataHelperObj=$null
            [CloudmineDataHelper]::CloudmineDataHelperInstance = $null
            [Build]::YamlBranchPolicies=@()
            [ADOSVTBase]::ResourceApprovalChecks = @()
            #Refresh singlton in different gads commands. (Powershell session keep cach object of the class, so need to make it null befor command run)
      
              [AutoBugLog]::AutoBugInstance = $null
              #Clear the cache of nested groups if the org name is not matching from previous scan in same session
            if ([ControlHelper]::GroupMembersResolutionObj.ContainsKey("OrgName") -and [ControlHelper]::GroupMembersResolutionObj["OrgName"] -ne $OrganizationName) {
                [ControlHelper]::GroupMembersResolutionObj = @{}
                [AdministratorHelper]::isCurrentUserPCA = $false
                [AdministratorHelper]::isCurrentUserPA= $false
                [AdministratorHelper]::AllPCAMembers = @()
                [AdministratorHelper]::AllPAMembers = @()
            }
      
            if ($PrepareForControlFix -eq $true)  {
                if ($UsePartialCommits -ne $true)  {
                    Write-Host "PrepareForControlFix switch requires -UsePartialCommits switch." -ForegroundColor Red
                    return;
                }
                elseif ([String]::IsNullOrEmpty($ControlIds) -or $ControlIds -match ','){
                    Write-Host "PrepareForControlFix switch requires one controlid. Use -ControlIds parameter to provide it." -ForegroundColor Red
                    return;
                }
            }

            if($PromptForPAT -eq $true)
            {
                if($null -ne $PATToken)
                {
                    Write-Host "Parameters '-PromptForPAT' and '-PATToken' can not be used simultaneously in the scan command." -ForegroundColor Red
                    return;
                }
                else
                {
                    $PATToken = Read-Host "Provide PAT for [$OrganizationName] org:" -AsSecureString
                }

            }

            if (-not [String]::IsNullOrEmpty($PATTokenURL))
            {
                # For now, if PAT URL is specified we will trigger an Azure login.
                $Context = @(Get-AzContext -ErrorAction SilentlyContinue )
                if ($Context.count -eq 0)  {
                    Write-Host "No active Azure login session found.`r`nPlease login to Azure tenant hosting the key vault..." -ForegroundColor Yellow
                    Connect-AzAccount -ErrorAction Stop
                    $Context = @(Get-AzContext -ErrorAction SilentlyContinue)
                }

                if ($null -eq $Context)  {
                    Write-Host "Login failed. Azure login context is required to use a key vault-based PAT token.`r`nStopping scan command." -ForegroundColor Red
                    return;
                }
                #Parse the key-vault-URL to determine vaultname, secretname, version
                if ($PATTokenURL -match "^https://(?<kv>[\w]+)(?:[\.\w+]*)/secrets/(?<sn>[\w]+)/?(?<sv>[\w]*)")
                {
                    $kvName = $Matches["kv"]
                    $secretName = $Matches["sn"]
                    $secretVersion = $Matches["sv"]

                    if (-not [String]::IsNullOrEmpty($secretVersion))
                    {
                        $kvSecret = Get-AzKeyVaultSecret -VaultName $kvName -SecretName $secretName -Version $secretVersion
                    }
                    else
                    {
                        $kvSecret = Get-AzKeyVaultSecret -VaultName $kvName -SecretName $secretName
                    }

                    if ($null -eq $kvSecret)
                    {
                        Write-Host "Could not extract PATToken from the given key vault URL.`r`nStopping scan command." -ForegroundColor Red
                        return;
                    }
                    $PATToken = $kvSecret.SecretValue;
                }
                else {
                    Write-Host "Could not extract PATToken from the given key vault URL.`r`nStopping scan command." -ForegroundColor Red
                    return;
                }
            }


            if ($ResetCredentials)
            {
                [ContextHelper]::PromptForLogin = $true
            }
            else
            {
                [ContextHelper]::PromptForLogin =$false
            }

            if(![string]::IsNullOrEmpty($BuildsFolderPath))
            {
                if($ResourceTypeName -notin([ResourceTypeName]::Build_Release,[ResourceTypeName]::Build))
                {
                    Write-Host "Parameter -ResourceTypeName(-rtn) should be Build/Build_Release when the parameter '-BuildsFolderPath' is used in the scan command." -ForegroundColor Red
                    return;
                }
            }

            if(![string]::IsNullOrEmpty($ReleasesFolderPath))
            {
                if($ResourceTypeName -notin([ResourceTypeName]::Build_Release,[ResourceTypeName]::Release))
                {
                    Write-Host "Parameter -ResourceTypeName(-rtn) should be Release/Build_Release when the parameter '-ReleasesFolderPath' is used in the scan command." -ForegroundColor Red
                    return;
                }
            }

            $resolver = [SVTResourceResolver]::new($OrganizationName,$ProjectNames,$BuildNames,$ReleaseNames,$AgentPoolNames, $ServiceConnectionNames, $VariableGroupNames, $MaxObj, $ScanAllResources, $PATToken,$ResourceTypeName, $AllowLongRunningScan, $ServiceIds, $IncludeAdminControls, $SkipOrgUserControls, $RepoNames, $SecureFileNames, $FeedNames, $EnvironmentNames, $BuildsFolderPath,$ReleasesFolderPath,$UsePartialCommits,$DoNotRefetchResources,$BatchScan, $IncrementalScan, $IncrementalDate);

            $secStatus = [ServicesSecurityStatus]::new($OrganizationName, $PSCmdlet.MyInvocation, $resolver);
            if ($secStatus)
            {
                if ($null -ne $secStatus.Resolver.SVTResources) {

                    $secStatus.ControlIdString = $ControlIds;
                    $secStatus.Severity = $Severity;
                    $secStatus.UseBaselineControls = $UseBaselineControls;
                    $secStatus.UsePreviewBaselineControls = $UsePreviewBaselineControls;

                    $secStatus.FilterTags = $FilterTags;
                    $secStatus.ExcludeTags = $ExcludeTags;

                    $secStatus.ExcludeControlIdString = $ExcludeControlIds

                    #build the attestation options object
                    [AttestationOptions] $attestationOptions = [AttestationOptions]::new();
                    $attestationOptions.AttestControls = $ControlsToAttest
                    $attestationOptions.JustificationText = $JustificationText
                    $attestationOptions.AttestationStatus = $AttestationStatus
                    $attestationOptions.IsBulkClearModeOn = $BulkClear
                    $attestationOptions.IsExemptModeOn = $AddException
                    $attestationOptions.ApprovedExceptionExpiryDate =  $ApprovedExceptionExpiryDate
                    $attestationOptions.ApprovedExceptionID = $ApprovedExceptionID
                    $secStatus.AttestationOptions = $attestationOptions;

                    return $secStatus.EvaluateControlStatus();
                }
            }
        }
        catch
        {
            [EventBase]::PublishGenericException($_);
        }
    }

    End
    {
        [ListenerHelper]::UnregisterListeners();
    }
}

# SIG # Begin signature block
# MIIoPAYJKoZIhvcNAQcCoIIoLTCCKCkCAQExDzANBglghkgBZQMEAgEFADB5Bgor
# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG
# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCIwKagsUT3UDVm
# omlD5ZspYL2u8hd6Ld9ZLgT2z1zxJqCCDYUwggYDMIID66ADAgECAhMzAAADri01
# UchTj1UdAAAAAAOuMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD
# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy
# b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p
# bmcgUENBIDIwMTEwHhcNMjMxMTE2MTkwODU5WhcNMjQxMTE0MTkwODU5WjB0MQsw
# CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u
# ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy
# b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
# AQD0IPymNjfDEKg+YyE6SjDvJwKW1+pieqTjAY0CnOHZ1Nj5irGjNZPMlQ4HfxXG
# yAVCZcEWE4x2sZgam872R1s0+TAelOtbqFmoW4suJHAYoTHhkznNVKpscm5fZ899
# QnReZv5WtWwbD8HAFXbPPStW2JKCqPcZ54Y6wbuWV9bKtKPImqbkMcTejTgEAj82
# 6GQc6/Th66Koka8cUIvz59e/IP04DGrh9wkq2jIFvQ8EDegw1B4KyJTIs76+hmpV
# M5SwBZjRs3liOQrierkNVo11WuujB3kBf2CbPoP9MlOyyezqkMIbTRj4OHeKlamd
# WaSFhwHLJRIQpfc8sLwOSIBBAgMBAAGjggGCMIIBfjAfBgNVHSUEGDAWBgorBgEE
# AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQUhx/vdKmXhwc4WiWXbsf0I53h8T8w
# VAYDVR0RBE0wS6RJMEcxLTArBgNVBAsTJE1pY3Jvc29mdCBJcmVsYW5kIE9wZXJh
# dGlvbnMgTGltaXRlZDEWMBQGA1UEBRMNMjMwMDEyKzUwMTgzNjAfBgNVHSMEGDAW
# gBRIbmTlUAXTgqoXNzcitW2oynUClTBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8v
# d3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNDb2RTaWdQQ0EyMDExXzIw
# MTEtMDctMDguY3JsMGEGCCsGAQUFBwEBBFUwUzBRBggrBgEFBQcwAoZFaHR0cDov
# L3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jZXJ0cy9NaWNDb2RTaWdQQ0EyMDEx
# XzIwMTEtMDctMDguY3J0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIB
# AGrJYDUS7s8o0yNprGXRXuAnRcHKxSjFmW4wclcUTYsQZkhnbMwthWM6cAYb/h2W
# 5GNKtlmj/y/CThe3y/o0EH2h+jwfU/9eJ0fK1ZO/2WD0xi777qU+a7l8KjMPdwjY
# 0tk9bYEGEZfYPRHy1AGPQVuZlG4i5ymJDsMrcIcqV8pxzsw/yk/O4y/nlOjHz4oV
# APU0br5t9tgD8E08GSDi3I6H57Ftod9w26h0MlQiOr10Xqhr5iPLS7SlQwj8HW37
# ybqsmjQpKhmWul6xiXSNGGm36GarHy4Q1egYlxhlUnk3ZKSr3QtWIo1GGL03hT57
# xzjL25fKiZQX/q+II8nuG5M0Qmjvl6Egltr4hZ3e3FQRzRHfLoNPq3ELpxbWdH8t
# Nuj0j/x9Crnfwbki8n57mJKI5JVWRWTSLmbTcDDLkTZlJLg9V1BIJwXGY3i2kR9i
# 5HsADL8YlW0gMWVSlKB1eiSlK6LmFi0rVH16dde+j5T/EaQtFz6qngN7d1lvO7uk
# 6rtX+MLKG4LDRsQgBTi6sIYiKntMjoYFHMPvI/OMUip5ljtLitVbkFGfagSqmbxK
# 7rJMhC8wiTzHanBg1Rrbff1niBbnFbbV4UDmYumjs1FIpFCazk6AADXxoKCo5TsO
# zSHqr9gHgGYQC2hMyX9MGLIpowYCURx3L7kUiGbOiMwaMIIHejCCBWKgAwIBAgIK
# YQ6Q0gAAAAAAAzANBgkqhkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNV
# BAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jv
# c29mdCBDb3Jwb3JhdGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlm
# aWNhdGUgQXV0aG9yaXR5IDIwMTEwHhcNMTEwNzA4MjA1OTA5WhcNMjYwNzA4MjEw
# OTA5WjB+MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE
# BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYD
# VQQDEx9NaWNyb3NvZnQgQ29kZSBTaWduaW5nIFBDQSAyMDExMIICIjANBgkqhkiG
# 9w0BAQEFAAOCAg8AMIICCgKCAgEAq/D6chAcLq3YbqqCEE00uvK2WCGfQhsqa+la
# UKq4BjgaBEm6f8MMHt03a8YS2AvwOMKZBrDIOdUBFDFC04kNeWSHfpRgJGyvnkmc
# 6Whe0t+bU7IKLMOv2akrrnoJr9eWWcpgGgXpZnboMlImEi/nqwhQz7NEt13YxC4D
# dato88tt8zpcoRb0RrrgOGSsbmQ1eKagYw8t00CT+OPeBw3VXHmlSSnnDb6gE3e+
# lD3v++MrWhAfTVYoonpy4BI6t0le2O3tQ5GD2Xuye4Yb2T6xjF3oiU+EGvKhL1nk
# kDstrjNYxbc+/jLTswM9sbKvkjh+0p2ALPVOVpEhNSXDOW5kf1O6nA+tGSOEy/S6
# A4aN91/w0FK/jJSHvMAhdCVfGCi2zCcoOCWYOUo2z3yxkq4cI6epZuxhH2rhKEmd
# X4jiJV3TIUs+UsS1Vz8kA/DRelsv1SPjcF0PUUZ3s/gA4bysAoJf28AVs70b1FVL
# 5zmhD+kjSbwYuER8ReTBw3J64HLnJN+/RpnF78IcV9uDjexNSTCnq47f7Fufr/zd
# sGbiwZeBe+3W7UvnSSmnEyimp31ngOaKYnhfsi+E11ecXL93KCjx7W3DKI8sj0A3
# T8HhhUSJxAlMxdSlQy90lfdu+HggWCwTXWCVmj5PM4TasIgX3p5O9JawvEagbJjS
# 4NaIjAsCAwEAAaOCAe0wggHpMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRI
# bmTlUAXTgqoXNzcitW2oynUClTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTAL
# BgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRyLToCMZBD
# uRQFTuHqp8cx0SOJNDBaBgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLm1pY3Jv
# c29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFf
# MDNfMjIuY3JsMF4GCCsGAQUFBwEBBFIwUDBOBggrBgEFBQcwAoZCaHR0cDovL3d3
# dy5taWNyb3NvZnQuY29tL3BraS9jZXJ0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFf
# MDNfMjIuY3J0MIGfBgNVHSAEgZcwgZQwgZEGCSsGAQQBgjcuAzCBgzA/BggrBgEF
# BQcCARYzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9kb2NzL3ByaW1h
# cnljcHMuaHRtMEAGCCsGAQUFBwICMDQeMiAdAEwAZQBnAGEAbABfAHAAbwBsAGkA
# YwB5AF8AcwB0AGEAdABlAG0AZQBuAHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQBn
# 8oalmOBUeRou09h0ZyKbC5YR4WOSmUKWfdJ5DJDBZV8uLD74w3LRbYP+vj/oCso7
# v0epo/Np22O/IjWll11lhJB9i0ZQVdgMknzSGksc8zxCi1LQsP1r4z4HLimb5j0b
# pdS1HXeUOeLpZMlEPXh6I/MTfaaQdION9MsmAkYqwooQu6SpBQyb7Wj6aC6VoCo/
# KmtYSWMfCWluWpiW5IP0wI/zRive/DvQvTXvbiWu5a8n7dDd8w6vmSiXmE0OPQvy
# CInWH8MyGOLwxS3OW560STkKxgrCxq2u5bLZ2xWIUUVYODJxJxp/sfQn+N4sOiBp
# mLJZiWhub6e3dMNABQamASooPoI/E01mC8CzTfXhj38cbxV9Rad25UAqZaPDXVJi
# hsMdYzaXht/a8/jyFqGaJ+HNpZfQ7l1jQeNbB5yHPgZ3BtEGsXUfFL5hYbXw3MYb
# BL7fQccOKO7eZS/sl/ahXJbYANahRr1Z85elCUtIEJmAH9AAKcWxm6U/RXceNcbS
# oqKfenoi+kiVH6v7RyOA9Z74v2u3S5fi63V4GuzqN5l5GEv/1rMjaHXmr/r8i+sL
# gOppO6/8MO0ETI7f33VtY5E90Z1WTk+/gFcioXgRMiF670EKsT/7qMykXcGhiJtX
# cVZOSEXAQsmbdlsKgEhr/Xmfwb1tbWrJUnMTDXpQzTGCGg0wghoJAgEBMIGVMH4x
# CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRt
# b25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01p
# Y3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMTECEzMAAAOuLTVRyFOPVR0AAAAA
# A64wDQYJYIZIAWUDBAIBBQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQw
# HAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIFwC
# LE0LjKGjKzYUhdfNLWp7EgOzMZ4hF9oPpIWPQ/X0MEIGCisGAQQBgjcCAQwxNDAy
# oBSAEgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5j
# b20wDQYJKoZIhvcNAQEBBQAEggEAWyw0yZXJYf2c78VSqs2QHmMzfIcFlNdREvJb
# uvJibhHEwm+moMUQKriLEVvtmVk/pVHukq2cBHt9DE7SENs4U/+3Zyn4X2TKxf/w
# U6BZyp47VlQ/j0aoytVmZ6kJRVACJWx1kyvUicZ/Yn/O7Hb5oJg51lxn98DVM1qe
# mLqfTQBlApezPnNWwEPmaBE07YZNO16l+hB26sMGqmPQRFNYpZSbB6k9zFrgg09h
# c7vhgh3vTTIrhzg9GuRn14KGCSHVqrJOM8KT+HOu9+L0TbHOrx69qyZ36t1gHtjP
# xcsQVXqAy6uS5fbA/Yh5G6D+5Rvg9t/Fk5wnqilS7rUZcQ+5X6GCF5cwgheTBgor
# BgEEAYI3AwMBMYIXgzCCF38GCSqGSIb3DQEHAqCCF3AwghdsAgEDMQ8wDQYJYIZI
# AWUDBAIBBQAwggFSBgsqhkiG9w0BCRABBKCCAUEEggE9MIIBOQIBAQYKKwYBBAGE
# WQoDATAxMA0GCWCGSAFlAwQCAQUABCAXncwzYPTSHI0yjrz5cXn0PDIQvoYbcGJu
# QpA9iLpwpQIGZbwTTZAmGBMyMDI0MDIxMzEyMjQ1Ni44MDNaMASAAgH0oIHRpIHO
# MIHLMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH
# UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQL
# ExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxk
# IFRTUyBFU046RjAwMi0wNUUwLUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1l
# LVN0YW1wIFNlcnZpY2WgghHtMIIHIDCCBQigAwIBAgITMwAAAfI+MtdkrHCRlAAB
# AAAB8jANBgkqhkiG9w0BAQsFADB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2Fz
# aGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENv
# cnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAx
# MDAeFw0yMzEyMDYxODQ1NThaFw0yNTAzMDUxODQ1NThaMIHLMQswCQYDVQQGEwJV
# UzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UE
# ChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1l
# cmljYSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046RjAwMi0w
# NUUwLUQ5NDcxJTAjBgNVBAMTHE1pY3Jvc29mdCBUaW1lLVN0YW1wIFNlcnZpY2Uw
# ggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC85fPLFwppYgxwYxkSEeYv
# QBtnYJTtKKj2FKxzHx0fgV6XgIIrmCWmpKl9IOzvOfJ/k6iP0RnoRo5F89Ad29ed
# zGdlWbCj1Qyx5HUHNY8yu9ElJOmdgeuNvTK4RW4wu9iB5/z2SeCuYqyX/v8z6Ppv
# 29h1ttNWsSc/KPOeuhzSAXqkA265BSFT5kykxvzB0LxoxS6oWoXWK6wx172NRJRY
# cINfXDhURvUfD70jioE92rW/OgjcOKxZkfQxLlwaFSrSnGs7XhMrp9TsUgmwsycT
# EOBdGVmf1HCD7WOaz5EEcQyIS2BpRYYwsPMbB63uHiJ158qNh1SJXuoL5wGDu/bZ
# UzN+BzcLj96ixC7wJGQMBixWH9d++V8bl10RYdXDZlljRAvS6iFwNzrahu4DrYb7
# b8M7vvwhEL0xCOvb7WFMsstscXfkdE5g+NSacphgFfcoftQ5qPD2PNVmrG38DmHD
# oYhgj9uqPLP7vnoXf7j6+LW8Von158D0Wrmk7CumucQTiHRyepEaVDnnA2GkiJoe
# h/r3fShL6CHgPoTB7oYU/d6JOncRioDYqqRfV2wlpKVO8b+VYHL8hn11JRFx6p69
# mL8BRtSZ6dG/GFEVE+fVmgxYfICUrpghyQlETJPITEBS15IsaUuW0GvXlLSofGf2
# t5DAoDkuKCbC+3VdPmlYVQIDAQABo4IBSTCCAUUwHQYDVR0OBBYEFJVbhwAm6tAx
# BM5cH8Bg0+Y64oZ5MB8GA1UdIwQYMBaAFJ+nFV0AXmJdg/Tl0mWnG1M1GelyMF8G
# A1UdHwRYMFYwVKBSoFCGTmh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMv
# Y3JsL01pY3Jvc29mdCUyMFRpbWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNybDBs
# BggrBgEFBQcBAQRgMF4wXAYIKwYBBQUHMAKGUGh0dHA6Ly93d3cubWljcm9zb2Z0
# LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwVGltZS1TdGFtcCUyMFBDQSUy
# MDIwMTAoMSkuY3J0MAwGA1UdEwEB/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUH
# AwgwDgYDVR0PAQH/BAQDAgeAMA0GCSqGSIb3DQEBCwUAA4ICAQA9S6eO4HsfB00X
# pOgPabcN3QZeyipgilcQSDZ8g6VCv9FVHzdSq9XpAsljZSKNWSClhJEz5Oo3Um/t
# aPnobF+8CkAdkcLQhLdkShfr91kzy9vDPrOmlCA2FQ9jVhFaat2QM33z1p+GCP5t
# uvirFaUWzUWVDFOpo/O5zDpzoPYtTr0cFg3uXaRLT54UQ3Y4uPYXqn6wunZtUQRM
# iJMzxpUlvdfWGUtCvnW3eDBikDkix1XE98VcYIz2+5fdcvrHVeUarGXy4LRtwzmw
# psCtUh7tR6whCrVYkb6FudBdWM7TVvji7pGgfjesgnASaD/ChLux66PGwaIaF+xL
# zk0bNxsAj0uhd6QdWr6TT39m/SNZ1/UXU7kzEod0vAY3mIn8X5A4I+9/e1nBNpUR
# J6YiDKQd5YVgxsuZCWv4Qwb0mXhHIe9CubfSqZjvDawf2I229N3LstDJUSr1vGFB
# 8iQ5W8ZLM5PwT8vtsKEBwHEYmwsuWmsxkimIF5BQbSzg9wz1O6jdWTxGG0OUt1cX
# WOMJUJzyEH4WSKZHOx53qcAvD9h0U6jEF2fuBjtJ/QDrWbb4urvAfrvqNn9lH7gV
# PplqNPDIvQ8DkZ3lvbQsYqlz617e76ga7SY0w71+QP165CPdzUY36et2Sm4pvspE
# K8hllq3IYcyX0v897+X9YeecM1Pb1jCCB3EwggVZoAMCAQICEzMAAAAVxedrngKb
# SZkAAAAAABUwDQYJKoZIhvcNAQELBQAwgYgxCzAJBgNVBAYTAlVTMRMwEQYDVQQI
# EwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3Nv
# ZnQgQ29ycG9yYXRpb24xMjAwBgNVBAMTKU1pY3Jvc29mdCBSb290IENlcnRpZmlj
# YXRlIEF1dGhvcml0eSAyMDEwMB4XDTIxMDkzMDE4MjIyNVoXDTMwMDkzMDE4MzIy
# NVowfDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcT
# B1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UE
# AxMdTWljcm9zb2Z0IFRpbWUtU3RhbXAgUENBIDIwMTAwggIiMA0GCSqGSIb3DQEB
# AQUAA4ICDwAwggIKAoICAQDk4aZM57RyIQt5osvXJHm9DtWC0/3unAcH0qlsTnXI
# yjVX9gF/bErg4r25PhdgM/9cT8dm95VTcVrifkpa/rg2Z4VGIwy1jRPPdzLAEBjo
# YH1qUoNEt6aORmsHFPPFdvWGUNzBRMhxXFExN6AKOG6N7dcP2CZTfDlhAnrEqv1y
# aa8dq6z2Nr41JmTamDu6GnszrYBbfowQHJ1S/rboYiXcag/PXfT+jlPP1uyFVk3v
# 3byNpOORj7I5LFGc6XBpDco2LXCOMcg1KL3jtIckw+DJj361VI/c+gVVmG1oO5pG
# ve2krnopN6zL64NF50ZuyjLVwIYwXE8s4mKyzbnijYjklqwBSru+cakXW2dg3viS
# kR4dPf0gz3N9QZpGdc3EXzTdEonW/aUgfX782Z5F37ZyL9t9X4C626p+Nuw2TPYr
# bqgSUei/BQOj0XOmTTd0lBw0gg/wEPK3Rxjtp+iZfD9M269ewvPV2HM9Q07BMzlM
# jgK8QmguEOqEUUbi0b1qGFphAXPKZ6Je1yh2AuIzGHLXpyDwwvoSCtdjbwzJNmSL
# W6CmgyFdXzB0kZSU2LlQ+QuJYfM2BjUYhEfb3BvR/bLUHMVr9lxSUV0S2yW6r1AF
# emzFER1y7435UsSFF5PAPBXbGjfHCBUYP3irRbb1Hode2o+eFnJpxq57t7c+auIu
# rQIDAQABo4IB3TCCAdkwEgYJKwYBBAGCNxUBBAUCAwEAATAjBgkrBgEEAYI3FQIE
# FgQUKqdS/mTEmr6CkTxGNSnPEP8vBO4wHQYDVR0OBBYEFJ+nFV0AXmJdg/Tl0mWn
# G1M1GelyMFwGA1UdIARVMFMwUQYMKwYBBAGCN0yDfQEBMEEwPwYIKwYBBQUHAgEW
# M2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvRG9jcy9SZXBvc2l0b3J5
# Lmh0bTATBgNVHSUEDDAKBggrBgEFBQcDCDAZBgkrBgEEAYI3FAIEDB4KAFMAdQBi
# AEMAQTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTV
# 9lbLj+iiXGJo0T2UkFvXzpoYxDBWBgNVHR8ETzBNMEugSaBHhkVodHRwOi8vY3Js
# Lm1pY3Jvc29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXRfMjAx
# MC0wNi0yMy5jcmwwWgYIKwYBBQUHAQEETjBMMEoGCCsGAQUFBzAChj5odHRwOi8v
# d3d3Lm1pY3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dF8yMDEwLTA2
# LTIzLmNydDANBgkqhkiG9w0BAQsFAAOCAgEAnVV9/Cqt4SwfZwExJFvhnnJL/Klv
# 6lwUtj5OR2R4sQaTlz0xM7U518JxNj/aZGx80HU5bbsPMeTCj/ts0aGUGCLu6WZn
# OlNN3Zi6th542DYunKmCVgADsAW+iehp4LoJ7nvfam++Kctu2D9IdQHZGN5tggz1
# bSNU5HhTdSRXud2f8449xvNo32X2pFaq95W2KFUn0CS9QKC/GbYSEhFdPSfgQJY4
# rPf5KYnDvBewVIVCs/wMnosZiefwC2qBwoEZQhlSdYo2wh3DYXMuLGt7bj8sCXgU
# 6ZGyqVvfSaN0DLzskYDSPeZKPmY7T7uG+jIa2Zb0j/aRAfbOxnT99kxybxCrdTDF
# NLB62FD+CljdQDzHVG2dY3RILLFORy3BFARxv2T5JL5zbcqOCb2zAVdJVGTZc9d/
# HltEAY5aGZFrDZ+kKNxnGSgkujhLmm77IVRrakURR6nxt67I6IleT53S0Ex2tVdU
# CbFpAUR+fKFhbHP+CrvsQWY9af3LwUFJfn6Tvsv4O+S3Fb+0zj6lMVGEvL8CwYKi
# excdFYmNcP7ntdAoGokLjzbaukz5m/8K6TT4JDVnK+ANuOaMmdbhIurwJ0I9JZTm
# dHRbatGePu1+oDEzfbzL6Xu/OHBE0ZDxyKs6ijoIYn/ZcGNTTY3ugm2lBRDBcQZq
# ELQdVTNYs6FwZvKhggNQMIICOAIBATCB+aGB0aSBzjCByzELMAkGA1UEBhMCVVMx
# EzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoT
# FU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjElMCMGA1UECxMcTWljcm9zb2Z0IEFtZXJp
# Y2EgT3BlcmF0aW9uczEnMCUGA1UECxMeblNoaWVsZCBUU1MgRVNOOkYwMDItMDVF
# MC1EOTQ3MSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1TdGFtcCBTZXJ2aWNloiMK
# AQEwBwYFKw4DAhoDFQBri943cFLH2TfQEfB05SLICg74CKCBgzCBgKR+MHwxCzAJ
# BgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25k
# MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jv
# c29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwMA0GCSqGSIb3DQEBCwUAAgUA6XW6HDAi
# GA8yMDI0MDIxMzA5NTEyNFoYDzIwMjQwMjE0MDk1MTI0WjB3MD0GCisGAQQBhFkK
# BAExLzAtMAoCBQDpdbocAgEAMAoCAQACAhvrAgH/MAcCAQACAhQpMAoCBQDpdwuc
# AgEAMDYGCisGAQQBhFkKBAIxKDAmMAwGCisGAQQBhFkKAwKgCjAIAgEAAgMHoSCh
# CjAIAgEAAgMBhqAwDQYJKoZIhvcNAQELBQADggEBADyEe3v8j6qWDL/TfdLlGo3h
# 7UF7HGIwsvqP1lAXWGK1/J4i0TeQoqZfJErhTPsuimD5vyNpu+4Oe/Kdjm48AK49
# D67EWrTJ3wYRFJB6lEm956Ypil7m6DJFE9Pnl3CqwdTV3vbIUFQM37JI3No14jOk
# 37BARqSBu8NMPaNt4qxmT3UFBCO2zE5W2S7KzuKZZwBqSC9zbc7pQP+TlpqcmTzc
# AujslBlL8VYizp97F3SD9VwqLtyJLw8dSz1e37abyDPlrdlW9r54Xgakimw6DbMS
# Wv6DAm5BL9REhOAR0EH1DlEseG2i0lmlPv8PIEzr7wO+hoiFX0FPUDe8L4sQp+Mx
# ggQNMIIECQIBATCBkzB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3Rv
# bjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0
# aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAxMAITMwAA
# AfI+MtdkrHCRlAABAAAB8jANBglghkgBZQMEAgEFAKCCAUowGgYJKoZIhvcNAQkD
# MQ0GCyqGSIb3DQEJEAEEMC8GCSqGSIb3DQEJBDEiBCBruQG4mVmF0yGXu1AUV2qr
# xUgnsBuycOOVRTOIuzKSNTCB+gYLKoZIhvcNAQkQAi8xgeowgecwgeQwgb0EIPja
# Ph0uMVJc04+Y4Ru5BUUbHE4suZ6nRHSUu0XXSkNEMIGYMIGApH4wfDELMAkGA1UE
# BhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAc
# BgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0
# IFRpbWUtU3RhbXAgUENBIDIwMTACEzMAAAHyPjLXZKxwkZQAAQAAAfIwIgQgXc6j
# fpHF+SRnElNcnNrLctrVa5z9PfeXcEz3ItpEDLUwDQYJKoZIhvcNAQELBQAEggIA
# HOOLw8luqf2Xd51MdidPB5Q1Fk2qy4U4CnL8H7nsnh8SVBBK1aikSDuBskZY1GP6
# Yog0D2oJERPGNMwSj+3zIaFi7sLw6DtG7Wyz0Y70fqFeigscVJEHncCvyPEZa9e7
# 6d4o3kP/Das7N1OFQj3U/0rAed5XNiVUZVkJ5yJqTrE6djs2LF+RUeJ2u3xXAEt1
# BGzNwf433GQiAbf5h3HrMCVCjktDNEFImchdkgkLkOhfA8C8kFJycGNq2TrXT4gS
# XQc262vfsYoNc0ue7pC7LzfxNDVWAf35zQiyYLXxiFlNPQlcXvN1vjcD+meHtde6
# 6jmSos6Lw2+yKv8uY663S4sx3lG6PqGfRp7JXZE/HDkohl0blD/gFU4mnwoOI7BP
# 5WnOMJFqhCqjklErh3ebrolLORA4jpEcyn7iYOHe7/P5oMOzBtpkvRi+Pyxqvm7/
# zhElA0IkIDw5I2HAqWXF/ZvEsuWe+u1HYCADpGiTemffPmhQwT1WZnAGpEMEPFDC
# GiHpaYm8p3HfiRehyo9l0qRgONBco9GS+HXYAzZrBWrl0EDS0PPaKBTr58Mkd+Rj
# EjqiHqKeCSJjuyIRyR/P+OPXIReFYfxbqwfPppaVlYdLW4PzD8eHV3nJxNOjbYLH
# mgCQWZ6AAAVCK8LrGLoM4tgngKudJP5u8Ioqrs/jeKo=
# SIG # End signature block