SCEPman

3.1.0-beta

Private/log-analytics.ps1

                                function GetLogAnalyticsWorkspace ($ResourceGroup, $WorkspaceId) {

    # Try to find by workspace id

    if($null -ne $WorkspaceId) {

        $workspaces = Invoke-Az @("graph", "query", "-q", "Resources | where type == 'microsoft.operationalinsights/workspaces' and properties.customerId == '$WorkspaceId' | project name, workspaceId = properties.customerId, location, resourceGroup") | Convert-LinesToObject

    }

    # Try to find by resource group

    if($null -eq $workspaces -or $workspaces.count -eq 0) {

        $workspaces = Invoke-Az @("graph", "query", "-q", "Resources | where type == 'microsoft.operationalinsights/workspaces' and resourceGroup == '$ResourceGroup' | project name, workspaceId = properties.customerId, location, resourceGroup") | Convert-LinesToObject

    }

    if($workspaces.count -eq 1) {

        Write-Information "Found log analytics workspace $($workspaces.data[0].name)"

        return $workspaces.data[0]

    } elseif($workspaces.count -gt 1) {

        Write-Information "Found log analytics workspaces:"

        $workspaces.data | ForEach-Object { Write-Information $_.name }

        $potentialWorkspaceName = Read-Host "We have found more than one existing log analytics workspace in the resource group $ResourceGroup. Please enter the name of the workspace you want to use"

        $potentialWorkspace = $workspaces.data | Where-Object { $_.name -eq $potentialWorkspaceName }

        if($null -eq $potentialWorkspace) {

            Write-Error "We couldn't find a log analytics workspace with name $potentialWorkspaceName in resource group $ResourceGroup. Please try to re-run the script"

            throw "We couldn't find a log analytics workspace with name $potentialWorkspaceName in resource group $ResourceGroup. Please try to re-run the script"

        } else {

            return $potentialWorkspace

        }

    }

    else {

        Write-Warning "Unable to determine the log analytics workspace"

        return $null

    }

}

function GetDataCollectionRule {

    param(

        [Parameter(Mandatory, ParameterSetName = "ByResourceGroup")]

        [string]$ResourceGroup,

        [Parameter(Mandatory, ParameterSetName = "ByDcrId")]

        [string]$DcrId

    )

    if($PSCmdlet.ParameterSetName -eq 'ByDcrId') {

        Write-Verbose "Looking for data collection rule with id $DcrId"

        $dataCollectionRule = Invoke-Az @("graph", "query", "-q", "Resources | where type == 'microsoft.insights/datacollectionrules' and properties.immutableId == '$DcrId' | project id, name, location, resourceGroup, endpoints = properties.endpoints, immutableId = properties.immutableId") | Convert-LinesToObject

    }

    if($PSCmdlet.ParameterSetName -eq 'ByResourceGroup') {

        Write-Verbose "Looking for data collection rules in the resource group $ResourceGroup"

        $dataCollectionRule = Invoke-Az @("graph", "query", "-q", "Resources | where type == 'microsoft.insights/datacollectionrules' and resourceGroup == '$ResourceGroup' | project id, name, location, resourceGroup, endpoints = properties.endpoints, immutableId = properties.immutableId") | Convert-LinesToObject

        if($dataCollectionRule.count -gt 1) {

            Write-Information "Found data collection rules:"

            $dataCollectionRule.data | ForEach-Object { Write-Information $_.name }

            $potentialDcrName = Read-Host "We have found more than one existing data collection rule in the resource group $ResourceGroup. Please enter the data collection rule you would like to use"

            # Check if the selected DCR is in our results

            $potentialDcr = $dataCollectionRule.data | Where-Object { $_.name -eq $potentialDcrName }

            if($null -eq $potentialDcr) {

                Write-Error "We couldn't find a data collection rule with name $potentialDcrName in resource group $ResourceGroup. Please try to re-run the script"

                throw "We couldn't find a data collection rule with name $potentialDcrName in resource group $ResourceGroup. Please try to re-run the script"

            } else {

                return $potentialDcr

            }

        }

    }

    if($dataCollectionRule.count -eq 1) {

        Write-Information "Found data collection rule $($dataCollectionRule.data[0].name)"

        return $dataCollectionRule.data[0]

    } else {

        Write-Warning "Unable to determine the data collection rule"

        return $null

    }

}

function GetLogAnalyticsTable($ResourceGroup, $WorkspaceAccount, $SubscriptionId, $tableName) {

    $table = Invoke-Az -MaxRetries 0 -azCommand @("monitor", "log-analytics", "workspace", "table", "show", "--resource-group", $ResourceGroup, "--workspace-name", $($WorkspaceAccount.name), "--name", $tableName) | Convert-LinesToObject

    return $table

}

function ValidateLogAnalyticsTable($ResourceGroup, $WorkspaceAccount, $SubscriptionId) {

    $LogsTableColumnDefinitions = @(

        @{ name="TimeGenerated"; type="datetime" },

        @{ name="Timestamp"; type="string" },

        @{ name="Level"; type="string" },

        @{ name="Message"; type="string" },

        @{ name="Exception"; type="string" },

        @{ name="TenantIdentifier"; type="string" },

        @{ name="RequestUrl"; type="string" },

        @{ name="UserAgent"; type="string" },

        @{ name="LogCategory"; type="string" },

        @{ name="EventId"; type="string" },

        @{ name="Hostname"; type="string" },

        @{ name="WebsiteHostname"; type="string" },

        @{ name="WebsiteSiteName"; type="string" },

        @{ name="WebsiteSlotName"; type="string" },

        @{ name="BaseUrl"; type="string" },

        @{ name="TraceIdentifier"; type="string" }

    )

    # Generate column definition strings for the az command

    $LogsTableColumns = $LogsTableColumnDefinitions | ForEach-Object { "$($_.name)=$($_.type)" }

    # Try to find table

    $tableDetails = GetLogAnalyticsTable -ResourceGroup $ResourceGroup -WorkspaceAccount $WorkspaceAccount -SubscriptionId $SubscriptionId -tableName $LogsTableName

    if ($null -eq $tableDetails) {

        Write-Verbose "Table $LogsTableName does not exist in the workspace $($WorkspaceAccount.name). Creating it now."

        $azCommandToCreateWorkspaceTable = @("monitor", "log-analytics", "workspace", "table", "create", "--resource-group", $ResourceGroup, "--workspace-name", $($WorkspaceAccount.name), "--name", $LogsTableName)

        # We add the columns separately as they would end up as a single string in the command otherwise which would fail

        $azCommandToCreateWorkspaceTable += "--columns"

        $azCommandToCreateWorkspaceTable += $LogsTableColumns

        $null = Invoke-Az $azCommandToCreateWorkspaceTable

        Write-Information "Table $LogsTableName successfully created in the workspace $($WorkspaceAccount.name)"

    } else {

        # We have a table already, check if it is of the correct type

        if ($tableDetails.schema.tableSubType -ne 'DataCollectionRuleBased') {

            Write-Information "Table $LogsTableName exists but is not of type DataCollectionRuleBased. Found subType: $($tableDetails.schema.tableSubType)"

            Write-Information "Migrating to DataCollectionRuleBased table."

            $azCommandToMigrateWorkspaceTable = @("monitor", "log-analytics", "workspace", "table", "migrate", "--resource-group", $ResourceGroup, "--workspace-name", $($WorkspaceAccount.name), "--table-name", $LogsTableName)

            $null = Invoke-Az $azCommandToMigrateWorkspaceTable

        } else {

            Write-Verbose "Table $LogsTableName already exists in the workspace $($WorkspaceAccount.name) with the correct subtype"

        }

        # We have a table of the correct type, check if all columns are present

        $existingColumnNames = ($tableDetails.schema.columns | ForEach-Object { $_.name }) + ($tableDetails.schema.standardColumns | ForEach-Object { $_.name })

        $missingColumns = @()

        foreach ($columnDefinition in $LogsTableColumnDefinitions) {

            if (-not ($existingColumnNames -contains $columnDefinition.name)) {

                $missingColumns += $columnDefinition

            }

        }

        if ($missingColumns.Count -gt 0) {

            Write-Verbose "Could not find $($missingColumns.Count) columns in table $LogsTableName"

            Write-Verbose "Missing columns: $($missingColumns | ForEach-Object { $_.name } | Join-String -Separator ', ')"

            Write-Information "Updating table schema."

            $azCommandToUpdateWorkspaceTableSchema = @("monitor", "log-analytics", "workspace", "table", "update", "--resource-group", $ResourceGroup, "--workspace-name", $($WorkspaceAccount.name), "--name", $LogsTableName)

            # We add the columns separately as they would end up as a single string in the command otherwise which would fail

            $azCommandToUpdateWorkspaceTableSchema += "--columns"

            $azCommandToUpdateWorkspaceTableSchema += $LogsTableColumns

            $null = Invoke-Az $azCommandToUpdateWorkspaceTableSchema

        }

    }

}

function ValidateDCR($ResourceGroup, $WorkspaceAccount, $WorkspaceResourceId) {

    # Define the destinations JSON in a variable

    $destinations = @{

        "logAnalytics" = @(

            @{

                "WorkspaceResourceId" = "$WorkspaceResourceId";

                "name" = "$LogsDestinationName"

            }

        )

    }

    # Define the streamDeclarations JSON in a variable

    $streamDeclarations = @{

        "Custom-SCEPmanLogs" = @{

            "columns" = @(

                @{ "name" = "Timestamp"; "type" = "string" },

                @{ "name" = "Level"; "type" = "string" },

                @{ "name" = "Message"; "type" = "string" },

                @{ "name" = "Exception"; "type" = "string" },

                @{ "name" = "TenantIdentifier"; "type" = "string" },

                @{ "name" = "RequestUrl"; "type" = "string" },

                @{ "name" = "UserAgent"; "type" = "string" },

                @{ "name" = "LogCategory"; "type" = "string" },

                @{ "name" = "EventId"; "type" = "string" },

                @{ "name" = "Hostname"; "type" = "string" },

                @{ "name" = "WebsiteHostname"; "type" = "string" },

                @{ "name" = "WebsiteSiteName"; "type" = "string" },

                @{ "name" = "WebsiteSlotName"; "type" = "string" },

                @{ "name" = "BaseUrl"; "type" = "string" },

                @{ "name" = "TraceIdentifier"; "type" = "string" },

                @{ "name" = "TimeGenerated"; "type" = "Datetime" }

            )

        }

    }

    # Define the dataFlows JSON in a variable

    $dataFlows = @(

        @{

            "streams" = @("Custom-SCEPmanLogs");

            "destinations" = @("$LogsDestinationName");

            "outputStream" = "Custom-$LogsTableName"

        }

    )

    $destinationsJson = HashTable2AzJson -psHashTable $destinations

    $streamDeclarationsJson = HashTable2AzJson -psHashTable $streamDeclarations

    $dataFlowsJson = HashTable2AzJson -psHashTable $dataFlows

    $existingDcrDetails = Invoke-Az -MaxRetries 0 -azCommand @("monitor", "data-collection", "rule", "show", "--resource-group", $ResourceGroup, "--name", $DCRName) | Convert-LinesToObject

    # Check if we need to create the DCR

    if($null -eq $existingDcrDetails) {

        Write-Verbose "Data Collection Rule $DCRName does not exist in the resource group $ResourceGroup. Creating it now."

        # Create DCR

        $newDcrDetails = Invoke-Az @("monitor", "data-collection", "rule", "create", "--resource-group", $ResourceGroup, "--name", $DCRName, "--description", "Data Collection Rule for SCEPman logs", "--stream-declarations", $streamDeclarationsJson, "--destinations", $destinationsJson, "--data-flows", $dataFlowsJson, "--kind", "Direct", "--location", $($WorkspaceAccount.location), "--only-show-errors") | Convert-LinesToObject

        Write-Information "Data Collection Rule $DCRName successfully created"

        return $newDcrDetails

    }

    # Verify existing DCR configuration

    $DCRNeedsUpdate = $false

    # Verify destinations

    if($existingDcrDetails.destinations.logAnalytics.count -eq 0 -or $existingDcrDetails.destinations.logAnalytics[0].name -ne $LogsDestinationName -or $existingDcrDetails.destinations.logAnalytics[0].workspaceResourceId -ne $WorkspaceResourceId) {

        Write-Information "Data Collection Rule $DCRName exists but does not have the correct Log Analytics destination configured. Updating it now."

        $DCRNeedsUpdate = $true

    }

    # Verify streamDeclaration

    if($null -eq $existingDcrDetails.streamDeclarations.'Custom-SCEPmanLogs') {

        Write-Information "Data Collection Rule $DCRName exists but does not have the correct stream declarations configured. Updating it now."

        $DCRNeedsUpdate = $true

    }

    # Verify streamDeclarations columns

    if($null -ne $existingDcrDetails.streamDeclarations.'Custom-SCEPmanLogs') {

        $missingColumns = 0

        $streamDeclarations.'Custom-SCEPmanLogs'.columns | ForEach-Object {

            $columnName = $_.name

            $existingColumn = $existingDcrDetails.streamDeclarations.'Custom-SCEPmanLogs'.columns | Where-Object { $_.name -eq $columnName }

            if($null -eq $existingColumn) {

                $missingColumns++

            }

        }

        if($missingColumns -gt 0) {

            Write-Verbose "Data Collection Rule $DCRName is missing $missingColumns columns in the stream declaration Custom-SCEPmanLogs. Updating it now."

            $DCRNeedsUpdate = $true

        }

    }

    # Verify dataFlows

    if($existingDcrDetails.dataFlows.count -eq 0 -or $existingDcrDetails.dataFlows[0].outputStream -ne $dataFlows[0].outputStream) {

        Write-Verbose "Data Collection Rule $DCRName exists but does not have the correct data flows configured. Updating it now."

        $DCRNeedsUpdate = $true

    }

    if($existingDcrDetails.dataFlows[0].streams -ne $dataFlows[0].streams) {

        Write-Verbose "Data Collection Rule $DCRName exists but does not have the correct data flows streams configured. Updating it now."

        $DCRNeedsUpdate = $true

    }

    if($DCRNeedsUpdate) {

        # Update DCR

        $updatedDcrDetails = Invoke-Az @("monitor", "data-collection", "rule", "update", "--resource-group", $ResourceGroup, "--name", $DCRName, "--description", "Data Collection Rule for SCEPman logs", "--stream-declarations", $streamDeclarationsJson, "--destinations", $destinationsJson, "--data-flows-raw", $dataFlowsJson, "--kind", "Direct", "--only-show-errors") | Convert-LinesToObject

        Write-Information "Data Collection Rule $DCRName successfully updated"

        return $updatedDcrDetails

    } else {

        Write-Information "Data Collection Rule $DCRName already exists with the correct configuration. Skipping the creation/update of the DCR"

        return $existingDcrDetails

    }

}

function GetRuleIdName($SubscriptionId, $ResourceGroup) {

    $ruleIdName = "/subscriptions/$SubscriptionId/resourceGroups/$ResourceGroup/providers/Microsoft.Insights/dataCollectionRules/$DCRName"

    return $ruleIdName

}

function ConfigureLogIngestionAPIResources() {

    [CmdletBinding(SupportsShouldProcess=$true)]

    param (

        [Parameter(Mandatory=$true)]        [PSCustomObject]$WorkspaceAccount,

        [Parameter(Mandatory=$true)]        [string]$SubscriptionId

    )

    Write-Information "Installing az monitor control service extension"

    Invoke-Az @("extension", "add", "--name", "monitor-control-service", "--only-show-errors")

    # Create the new table

    if ($PSCmdlet.ShouldProcess("$WorkspaceAccount", "Validating log analytics workspace table and creating if it does not exist")) {

        ValidateLogAnalyticsTable -ResourceGroup $WorkspaceAccount.resourceGroup -WorkspaceAccount $WorkspaceAccount -SubscriptionId $SubscriptionId

    }

     # Create the DCR

    $workspaceResourceId = "/subscriptions/$SubscriptionId/resourceGroups/$($WorkspaceAccount.resourceGroup)/providers/microsoft.operationalinsights/workspaces/$($WorkspaceAccount.name)"

    if ($PSCmdlet.ShouldProcess("$WorkspaceAccount", "Validating Data Collection Rule and creating/updating if it does not exist or is misconfigured")) {

         $dcrDetails = ValidateDCR -ResourceGroup $WorkspaceAccount.resourceGroup -WorkspaceAccount $WorkspaceAccount -WorkspaceResourceId $workspaceResourceId

    }

    return $dcrDetails

}

function AddAppRoleAssignmentsForLogIngestionAPI($DcrResourceId, $ServicePrincipal, $SkipAppRoleAssignments = $false) {

    $azCommandToAssignRole = "az role assignment create --role 'Monitoring Metrics Publisher' --assignee-object-id $($ServicePrincipal) --assignee-principal-type ServicePrincipal --scope $DcrResourceId"

    if($SkipAppRoleAssignments) {

        Write-Warning "Skipping app role assignment (please execute manually): $azCommandToAssignRole"

        return

    }

    $null = ExecuteAzCommandRobustly -azCommand $azCommandToAssignRole

    Write-Verbose "Role 'Monitoring Metrics Publisher' assigned to service principal $ServicePrincipal for the scope of the Data Collection Rule with resource id $DcrResourceId"

}

function Set-LoggingConfigInAppSettings {

    [CmdletBinding(SupportsShouldProcess=$true)]

    # No settings are passed but a group of defined settings is applied/removed, so plural noun is appropriate here

    [Diagnostics.CodeAnalysis.SuppressMessageAttribute("PSUseSingularNouns", "")]

    param (

        [Parameter(Mandatory=$true)]        [string]$SubscriptionId,

        [Parameter(Mandatory=$true)]        [string]$ResourceGroup,

        [Parameter(Mandatory=$true)]        [string]$AppServiceName,

        [Parameter(Mandatory=$false)]        [System.Collections.IList]$servicePrincipals,

        [Parameter(Mandatory=$false)]        [string]$DeploymentSlotName,

        [Parameter(Mandatory=$false)]        [System.Collections.IList]$DeploymentSlots,

        [switch]$SkipAppRoleAssignments

    )

    # Check if we have an existing logging configuration

    $existingWorkspaceId = ReadAppSetting -ResourceGroup $ResourceGroup -AppServiceName $AppServiceName -SettingName "AppConfig:LoggingConfig:WorkspaceId" -Slot $DeploymentSlotName

    $existingDcrRuleId = ReadAppSetting -ResourceGroup $ResourceGroup -AppServiceName $AppServiceName -SettingName "AppConfig:LoggingConfig:RuleId" -Slot $DeploymentSlotName

    # Decide whether we create a DCR or not based on existing logging configuration

    if (-not [string]::IsNullOrEmpty($existingWorkspaceId) -and [string]::IsNullOrEmpty($existingDcrRuleId)) {

        Write-Information "Missing Log Ingestion API configuration detected while using existing log analytics workspace. Proceeding to configure Log Ingestion API resources."

        # Get LAW resource details

        $workspaceAccount = GetLogAnalyticsWorkspace -ResourceGroup $ResourceGroup -WorkspaceId $existingWorkspaceId

        if ($null -eq $workspaceAccount) {

            Write-Warning "Could not find the log analytics workspace with id $existingWorkspaceId. Please check if the workspace still exists or if the app setting is configured correctly. Skipping Log Ingestion API configuration."

            return

        }

        # Validate the log table and create or validate the DCR in the workspace resource group

        $dcrDetails = ConfigureLogIngestionAPIResources -WorkspaceAccount $workspaceAccount -SubscriptionId $SubscriptionId

    } elseif (-not [string]::IsNullOrEmpty($existingDcrRuleId)) {

        Write-Information "Existing Log Ingestion API configuration detected. Validate permissions"

        # Get DCR details

        $dcrDetails = GetDataCollectionRule -DcrId $existingDcrRuleId

        if ($null -eq $dcrDetails) {

            Write-Warning "Unable to find existing Data Collection Rule with id $existingDcrRuleId"

            return

        }

    } else {

        Write-Information "Neither existing log analytics workspace nor existing Log Ingestion API configuration detected. Check if we have a log analytics workspace in the resource group."

        # Try to find LAW in our resource group

        $workspaceAccount = GetLogAnalyticsWorkspace -ResourceGroup $ResourceGroup

        if ($null -eq $workspaceAccount) {

            Write-Information "No existing log analytics workspace found. Skipping logging configuration."

            return

        }

        # Validate the log table and create or validate the DCR in the workspace resource group

        $dcrDetails = ConfigureLogIngestionAPIResources -WorkspaceAccount $workspaceAccount -SubscriptionId $SubscriptionId

    }

    if($null -eq $dcrDetails -or [string]::IsNullOrEmpty($dcrDetails.immutableId) -or [string]::IsNullOrEmpty($dcrDetails.endpoints.logsIngestion)) {

        Write-Warning "Unable to configure Log Ingestion API due to missing Data Collection Rule details. Skipping Log Ingestion API configuration."

        return

    }

    $SettingsToRemove = @("AppConfig:LoggingConfig:WorkspaceId", "AppConfig:LoggingConfig:SharedKey")

    $SettingsToAdd = @(

        @{ name='AppConfig:LoggingConfig:DataCollectionEndpointUri'; value=$($DcrDetails.endpoints.logsIngestion) },

        @{ name='AppConfig:LoggingConfig:RuleId'; value=$($DcrDetails.immutableId) }

    )

    if([String]::IsNullOrEmpty($DeploymentSlotName)) {

        # In case we do not have a deployment slot, we just update the app settings of the app service

        # If we got a deployment slot, it will be handled in the slots loop below

        Write-Information "Configuring Log Ingestion API settings in App Service $AppServiceName"

        if ($PSCmdlet.ShouldProcess($AppServiceName, "Setting Log Ingestion API app settings in the App Service")) {

            RemoveAppSettings -AppServiceName $AppServiceName -ResourceGroup $ResourceGroup -SettingNames $SettingsToRemove

            SetAppSettings -AppServiceName $AppServiceName -ResourceGroup $ResourceGroup -Settings $SettingsToAdd

        }

    }

    ForEach($tempDeploymentSlot in $DeploymentSlots) {

        Write-Information "Configuring Log Ingestion API settings in App Service $AppServiceName in slot $tempDeploymentSlot"

        if ($PSCmdlet.ShouldProcess("$AppServiceName/$tempDeploymentSlot", "Setting Log Ingestion API app settings in the App Service Slot")) {

            RemoveAppSettings -AppServiceName $AppServiceName -ResourceGroup $ResourceGroup -SettingNames $SettingsToRemove -Slot $tempDeploymentSlot

            SetAppSettings -AppServiceName $AppServiceName -ResourceGroup $ResourceGroup -Settings $SettingsToAdd -Slot $tempDeploymentSlot

        }

    }

    # If we receive principals, we also assign the correct RBAC roles

    # This will only happen during the SCEPman call which will then also include the principal of CM

    if($servicePrincipals) {

        Foreach($principal in $servicePrincipals) {

            if ($PSCmdlet.ShouldProcess($principal, "Adding app role assignment for Monitoring Metrics Publisher role")) {

                AddAppRoleAssignmentsForLogIngestionAPI -DcrResourceId $dcrDetails.id -ServicePrincipal $principal -SkipAppRoleAssignments $SkipAppRoleAssignments

            }

        }

    }

}

# SIG # Begin signature block

# MIIv6wYJKoZIhvcNAQcCoIIv3DCCL9gCAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBCHJyTGrdIeiJA

# DO7Fz4bbJQU5fMGOEROxfKYZ7sX8NqCCFA4wggVyMIIDWqADAgECAhB2U/6sdUZI

# k/Xl10pIOk74MA0GCSqGSIb3DQEBDAUAMFMxCzAJBgNVBAYTAkJFMRkwFwYDVQQK

# ExBHbG9iYWxTaWduIG52LXNhMSkwJwYDVQQDEyBHbG9iYWxTaWduIENvZGUgU2ln

# bmluZyBSb290IFI0NTAeFw0yMDAzMTgwMDAwMDBaFw00NTAzMTgwMDAwMDBaMFMx

# CzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSkwJwYDVQQD

# EyBHbG9iYWxTaWduIENvZGUgU2lnbmluZyBSb290IFI0NTCCAiIwDQYJKoZIhvcN

# AQEBBQADggIPADCCAgoCggIBALYtxTDdeuirkD0DcrA6S5kWYbLl/6VnHTcc5X7s

# k4OqhPWjQ5uYRYq4Y1ddmwCIBCXp+GiSS4LYS8lKA/Oof2qPimEnvaFE0P31PyLC

# o0+RjbMFsiiCkV37WYgFC5cGwpj4LKczJO5QOkHM8KCwex1N0qhYOJbp3/kbkbuL

# ECzSx0Mdogl0oYCve+YzCgxZa4689Ktal3t/rlX7hPCA/oRM1+K6vcR1oW+9YRB0

# RLKYB+J0q/9o3GwmPukf5eAEh60w0wyNA3xVuBZwXCR4ICXrZ2eIq7pONJhrcBHe

# OMrUvqHAnOHfHgIB2DvhZ0OEts/8dLcvhKO/ugk3PWdssUVcGWGrQYP1rB3rdw1G

# R3POv72Vle2dK4gQ/vpY6KdX4bPPqFrpByWbEsSegHI9k9yMlN87ROYmgPzSwwPw

# jAzSRdYu54+YnuYE7kJuZ35CFnFi5wT5YMZkobacgSFOK8ZtaJSGxpl0c2cxepHy

# 1Ix5bnymu35Gb03FhRIrz5oiRAiohTfOB2FXBhcSJMDEMXOhmDVXR34QOkXZLaRR

# kJipoAc3xGUaqhxrFnf3p5fsPxkwmW8x++pAsufSxPrJ0PBQdnRZ+o1tFzK++Ol+

# A/Tnh3Wa1EqRLIUDEwIrQoDyiWo2z8hMoM6e+MuNrRan097VmxinxpI68YJj8S4O

# JGTfAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0G

# A1UdDgQWBBQfAL9GgAr8eDm3pbRD2VZQu86WOzANBgkqhkiG9w0BAQwFAAOCAgEA

# Xiu6dJc0RF92SChAhJPuAW7pobPWgCXme+S8CZE9D/x2rdfUMCC7j2DQkdYc8pzv

# eBorlDICwSSWUlIC0PPR/PKbOW6Z4R+OQ0F9mh5byV2ahPwm5ofzdHImraQb2T07

# alKgPAkeLx57szO0Rcf3rLGvk2Ctdq64shV464Nq6//bRqsk5e4C+pAfWcAvXda3

# XaRcELdyU/hBTsz6eBolSsr+hWJDYcO0N6qB0vTWOg+9jVl+MEfeK2vnIVAzX9Rn

# m9S4Z588J5kD/4VDjnMSyiDN6GHVsWbcF9Y5bQ/bzyM3oYKJThxrP9agzaoHnT5C

# JqrXDO76R78aUn7RdYHTyYpiF21PiKAhoCY+r23ZYjAf6Zgorm6N1Y5McmaTgI0q

# 41XHYGeQQlZcIlEPs9xOOe5N3dkdeBBUO27Ql28DtR6yI3PGErKaZND8lYUkqP/f

# obDckUCu3wkzq7ndkrfxzJF0O2nrZ5cbkL/nx6BvcbtXv7ePWu16QGoWzYCELS/h

# AtQklEOzFfwMKxv9cW/8y7x1Fzpeg9LJsy8b1ZyNf1T+fn7kVqOHp53hWVKUQY9t

# W76GlZr/GnbdQNJRSnC0HzNjI3c/7CceWeQIh+00gkoPP/6gHcH1Z3NFhnj0qinp

# J4fGGdvGExTDOUmHTaCX4GUT9Z13Vunas1jHOvLAzYIwggboMIIE0KADAgECAhB3

# vQ4Ft1kLth1HYVMeP3XtMA0GCSqGSIb3DQEBCwUAMFMxCzAJBgNVBAYTAkJFMRkw

# FwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSkwJwYDVQQDEyBHbG9iYWxTaWduIENv

# ZGUgU2lnbmluZyBSb290IFI0NTAeFw0yMDA3MjgwMDAwMDBaFw0zMDA3MjgwMDAw

# MDBaMFwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTIw

# MAYDVQQDEylHbG9iYWxTaWduIEdDQyBSNDUgRVYgQ29kZVNpZ25pbmcgQ0EgMjAy

# MDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMsg75ceuQEyQ6BbqYoj

# /SBerjgSi8os1P9B2BpV1BlTt/2jF+d6OVzA984Ro/ml7QH6tbqT76+T3PjisxlM

# g7BKRFAEeIQQaqTWlpCOgfh8qy+1o1cz0lh7lA5tD6WRJiqzg09ysYp7ZJLQ8LRV

# X5YLEeWatSyyEc8lG31RK5gfSaNf+BOeNbgDAtqkEy+FSu/EL3AOwdTMMxLsvUCV

# 0xHK5s2zBZzIU+tS13hMUQGSgt4T8weOdLqEgJ/SpBUO6K/r94n233Hw0b6nskEz

# IHXMsdXtHQcZxOsmd/KrbReTSam35sOQnMa47MzJe5pexcUkk2NvfhCLYc+YVaMk

# oog28vmfvpMusgafJsAMAVYS4bKKnw4e3JiLLs/a4ok0ph8moKiueG3soYgVPMLq

# 7rfYrWGlr3A2onmO3A1zwPHkLKuU7FgGOTZI1jta6CLOdA6vLPEV2tG0leis1Ult

# 5a/dm2tjIF2OfjuyQ9hiOpTlzbSYszcZJBJyc6sEsAnchebUIgTvQCodLm3HadNu

# twFsDeCXpxbmJouI9wNEhl9iZ0y1pzeoVdwDNoxuz202JvEOj7A9ccDhMqeC5LYy

# AjIwfLWTyCH9PIjmaWP47nXJi8Kr77o6/elev7YR8b7wPcoyPm593g9+m5XEEofn

# GrhO7izB36Fl6CSDySrC/blTAgMBAAGjggGtMIIBqTAOBgNVHQ8BAf8EBAMCAYYw

# EwYDVR0lBAwwCgYIKwYBBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4E

# FgQUJZ3Q/FkJhmPF7POxEztXHAOSNhEwHwYDVR0jBBgwFoAUHwC/RoAK/Hg5t6W0

# Q9lWULvOljswgZMGCCsGAQUFBwEBBIGGMIGDMDkGCCsGAQUFBzABhi1odHRwOi8v

# b2NzcC5nbG9iYWxzaWduLmNvbS9jb2Rlc2lnbmluZ3Jvb3RyNDUwRgYIKwYBBQUH

# MAKGOmh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2NvZGVzaWdu

# aW5ncm9vdHI0NS5jcnQwQQYDVR0fBDowODA2oDSgMoYwaHR0cDovL2NybC5nbG9i

# YWxzaWduLmNvbS9jb2Rlc2lnbmluZ3Jvb3RyNDUuY3JsMFUGA1UdIAROMEwwQQYJ

# KwYBBAGgMgECMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8vd3d3Lmdsb2JhbHNpZ24u

# Y29tL3JlcG9zaXRvcnkvMAcGBWeBDAEDMA0GCSqGSIb3DQEBCwUAA4ICAQAldaAJ

# yTm6t6E5iS8Yn6vW6x1L6JR8DQdomxyd73G2F2prAk+zP4ZFh8xlm0zjWAYCImbV

# YQLFY4/UovG2XiULd5bpzXFAM4gp7O7zom28TbU+BkvJczPKCBQtPUzosLp1pnQt

# pFg6bBNJ+KUVChSWhbFqaDQlQq+WVvQQ+iR98StywRbha+vmqZjHPlr00Bid/XSX

# hndGKj0jfShziq7vKxuav2xTpxSePIdxwF6OyPvTKpIz6ldNXgdeysEYrIEtGiH6

# bs+XYXvfcXo6ymP31TBENzL+u0OF3Lr8psozGSt3bdvLBfB+X3Uuora/Nao2Y8nO

# ZNm9/Lws80lWAMgSK8YnuzevV+/Ezx4pxPTiLc4qYc9X7fUKQOL1GNYe6ZAvytOH

# X5OKSBoRHeU3hZ8uZmKaXoFOlaxVV0PcU4slfjxhD4oLuvU/pteO9wRWXiG7n9dq

# cYC/lt5yA9jYIivzJxZPOOhRQAyuku++PX33gMZMNleElaeEFUgwDlInCI2Oor0i

# xxnJpsoOqHo222q6YV8RJJWk4o5o7hmpSZle0LQ0vdb5QMcQlzFSOTUpEYck08T7

# qWPLd0jV+mL8JOAEek7Q5G7ezp44UCb0IXFl1wkl1MkHAHq4x/N36MXU4lXQ0x72

# f1LiSY25EXIMiEQmM2YBRN/kMw4h3mKJSAfa9TCCB6gwggWQoAMCAQICDF3VjaKN

# us83AvC1UTANBgkqhkiG9w0BAQsFADBcMQswCQYDVQQGEwJCRTEZMBcGA1UEChMQ

# R2xvYmFsU2lnbiBudi1zYTEyMDAGA1UEAxMpR2xvYmFsU2lnbiBHQ0MgUjQ1IEVW

# IENvZGVTaWduaW5nIENBIDIwMjAwHhcNMjUxMTI3MTcwNDI2WhcNMjcxMTI4MTcw

# NDI2WjCCAQwxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRIwEAYDVQQF

# EwlIUkIgMTIzODExEzARBgsrBgEEAYI3PAIBAxMCREUxFzAVBgsrBgEEAYI3PAIB

# AhMGSGVzc2VuMSIwIAYLKwYBBAGCNzwCAQETEU9mZmVuYmFjaCBhbSBNYWluMQsw

# CQYDVQQGEwJERTEPMA0GA1UECBMGSGVzc2VuMRowGAYDVQQHExFPZmZlbmJhY2gg

# YW0gTWFpbjEZMBcGA1UECQwQS2Fpc2Vyc3RyYcOfZSAzOTEXMBUGA1UEChMOZ2x1

# ZWNra2FuamEgQUcxFzAVBgNVBAMTDmdsdWVja2thbmphIEFHMIICIjANBgkqhkiG

# 9w0BAQEFAAOCAg8AMIICCgKCAgEAkQoXi0dUFVttodx+Ydj1O6EZZqgDdlSGDA/6

# x1UCkMrWNVEW+LdbUGU8KW7fUcKPCAcDJNrXfXxZeBht2G4pPvhaMz/kBdSK6bI1

# sqo1WSN//beapdUefQpq/wgnUneq13tEJQAke6EWdLyidObcogBSp9wCXBbMWsTO

# utgCONjyu8AilmzRY+94lO7VwUA2LGGPX8FRAEt5AMzifsEo2lIEKiDou2H8HUUC

# PibiChiuT3oGIDYYnCA/RzS44E0cAuAzlD3NQNCeIDzfoFiUD8mAC1gYU6i8yIej

# jUGl8+kpbpBYjgzwbsiCBn0rDhrlpJ3MHkZCrp82kzWK0l7c3ukNvdlGcU4tKdXk

# AHgpJecdYUDvz9iaYFvYEivF+Jg+Tc8ZnzsP5/q3KKw4g0QiJ+MXgvwJx8OSvAKW

# tkwkLxgE9oxufs3Y8xsmwyWqxWDBcyzzvs6yISnUaeTtGmyB8BsEbahDFrxHhV6U

# nwxNpJ+iM+j08J1tNIW0AXjY6ojGOIC8IIL+EiK34MXJ6Jxy22mntMnc6ztK6c7H

# IKiRHIPX4jXtg7IYRS/k5muuIt/xKzN7qtF9xJbaZi8jRE6fgWDwszLJUMHSLthh

# yKTsUEvuqZ79WnSHErg26EPQYirAY/IFt7Z7+3SDW2WI8uG2qY6hkpE0hm+/F3uS

# M+s98jUCAwEAAaOCAbYwggGyMA4GA1UdDwEB/wQEAwIHgDCBnwYIKwYBBQUHAQEE

# gZIwgY8wTAYIKwYBBQUHMAKGQGh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20v

# Y2FjZXJ0L2dzZ2NjcjQ1ZXZjb2Rlc2lnbmNhMjAyMC5jcnQwPwYIKwYBBQUHMAGG

# M2h0dHA6Ly9vY3NwLmdsb2JhbHNpZ24uY29tL2dzZ2NjcjQ1ZXZjb2Rlc2lnbmNh

# MjAyMDBVBgNVHSAETjBMMEEGCSsGAQQBoDIBAjA0MDIGCCsGAQUFBwIBFiZodHRw

# czovL3d3dy5nbG9iYWxzaWduLmNvbS9yZXBvc2l0b3J5LzAHBgVngQwBAzAJBgNV

# HRMEAjAAMEcGA1UdHwRAMD4wPKA6oDiGNmh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5j

# b20vZ3NnY2NyNDVldmNvZGVzaWduY2EyMDIwLmNybDATBgNVHSUEDDAKBggrBgEF

# BQcDAzAfBgNVHSMEGDAWgBQlndD8WQmGY8Xs87ETO1ccA5I2ETAdBgNVHQ4EFgQU

# q/cn5ijjtp0mG1yoiF02hg4dx4IwDQYJKoZIhvcNAQELBQADggIBAJ1TZv/rvy2w

# jANcL/kb6rTk+/6L7l49UghLghUKFVfrdEEc+21iexA7zlkvhM0TrhdiFU7TjDky

# InPctzsDlqwUhawEx4PT8ZkZkZzm25YWaqtZH44st/Fz59KiG+85NUdRd+0cL3Y8

# NR66z3xfI6K3W/nrIcE6RHm/opOM+L02Hd2MBligLnoFYcTvR3NPCA21A6+IOaYM

# n5YZzNKFXWry8ZHpWjnE4u9mxHYpS1zu2aIkwL8mfYM5moYoh0PAcp9XA5Sm4KrV

# LeIzZ3HIy4EzLCbFBP+OGFpkqq8pTtmYItG+g1rYEg5a8egrY83zJMHazaTFBgRI

# MNXCgeMZhC8O6NsAtbj3FSbiYKg1hNwZzHYL+uL3jcPZjuUoOpmvXu67xWs4ZfdT

# Mluy5E7FyWwtnOjr/04EXWyKATYMDIkd47Wqam/ZB7umF5T5YPnmTlv18ArEXuVQ

# EEpS/cN90DtRz2OGruu+V9bg3fk6NKDJLve8detDOTTBN0C/bFGxI5YLHmwVAdaq

# pz3t14ShRjVcxP7aN0bEL3YOuQvjnjQGe29H6n/MPf8UG4WYMd+a8qIP4HROLJq0

# YJylzYBglqoQeQC/OG+PtWTvL9oByPVYNc+llAuap/xmWSLZgAqPbi+PAfow69Lg

# bppHUCnJhNkXD/mJ4qB0KvPG+bzL19dEMYIbMzCCGy8CAQEwbDBcMQswCQYDVQQG

# EwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEyMDAGA1UEAxMpR2xvYmFs

# U2lnbiBHQ0MgUjQ1IEVWIENvZGVTaWduaW5nIENBIDIwMjACDF3VjaKNus83AvC1

# UTANBglghkgBZQMEAgEFAKCBhDAYBgorBgEEAYI3AgEMMQowCKACgAChAoAAMBkG

# CSqGSIb3DQEJAzEMBgorBgEEAYI3AgEEMBwGCisGAQQBgjcCAQsxDjAMBgorBgEE

# AYI3AgEVMC8GCSqGSIb3DQEJBDEiBCCKIz2j9a3zeZldluY1f/7WTKA2BsCNcEDk

# ZTFWVJMYSzANBgkqhkiG9w0BAQEFAASCAgA73SEtm+n+eh7aCYI+ItbXTNaF8jO/

# xBt9VGnsC/B3jSduxHS9u0FjwtWxNCaPYPp3J40Ii1jMtZ6WdrIRk+UsTLoza33K

# hqXY/XGzhIkftj+e+GS/lbxkBavTR+NPjM3shWPZNUxjLhZSNiZIYM9DIfr0SBcU

# /ZvsMYrgferrBZ3RrrE2NeWtLO78bTyhEyjCAaxQpx0ing9meYk2Vtk6Fr5wZDFl

# krC9eiC/L1PG+VqtAV6LXBrCTAdNHPPivYX8AOAcaJwUXI7BNU3DFoFgiiCd0P9L

# WaGt1EeuQakzjZIsqUiHOX0z2ecv9AGQ6G/Q0FLCTL1q4pKcv58ek5tLobA124ab

# g0t6zm+e5Ge0BfLqoyLlfzWaxwLy1GQg4rnWwseYj+OeTQ9dBbkuJbrFWY6V8t8D

# GTCpeI/u8/+Jbg1YiGBrd0nW/KTwtr2H0Xp/yPMfvqivqmPILBunwyPk1bG2Skx6

# 1wE9lCSKVdkc4bict6HPxMa9qM2QiGc1MSseDRs6MeOqdxC4O/iK+ZYGf0hk/Y0M

# qRPVUSjTrp4U3rR+IOlcr5/ZDmPJu9/OkPvjqz0agZ4yh5PdvqC6j543AeiaZJu7

# ws6rMNjnG8XLMDfN3KqlVqp9gR02/uoUjNv/oq4H8YqRdvI3LY24Ey28LIYe7LbB

# av0GDYq4XUdx5KGCGBEwghgNBgorBgEEAYI3AwMBMYIX/TCCF/kGCSqGSIb3DQEH

# AqCCF+owghfmAgEDMQ8wDQYJYIZIAWUDBAIBBQAwggFiBgsqhkiG9w0BCRABBKCC

# AVEEggFNMIIBSQIBAQYKKwYBBAGEWQoDATAxMA0GCWCGSAFlAwQCAQUABCBcxIGM

# 8/fX/6tQzJapTBsvORmAyYyodBmTfEciigo/QgIGaeiBS78pGBMyMDI2MDUyNzEx

# NTkwNC43MDFaMASAAgH0oIHhpIHeMIHbMQswCQYDVQQGEwJVUzETMBEGA1UECBMK

# V2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0

# IENvcnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRp

# b25zMScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046N0QwMC0wNUUwLUQ5NDcxNTAz

# BgNVBAMTLE1pY3Jvc29mdCBQdWJsaWMgUlNBIFRpbWUgU3RhbXBpbmcgQXV0aG9y

# aXR5oIIPITCCB4IwggVqoAMCAQICEzMAAAAF5c8P/2YuyYcAAAAAAAUwDQYJKoZI

# hvcNAQEMBQAwdzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jw

# b3JhdGlvbjFIMEYGA1UEAxM/TWljcm9zb2Z0IElkZW50aXR5IFZlcmlmaWNhdGlv

# biBSb290IENlcnRpZmljYXRlIEF1dGhvcml0eSAyMDIwMB4XDTIwMTExOTIwMzIz

# MVoXDTM1MTExOTIwNDIzMVowYTELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jv

# c29mdCBDb3Jwb3JhdGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0IFB1YmxpYyBSU0Eg

# VGltZXN0YW1waW5nIENBIDIwMjAwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK

# AoICAQCefOdSY/3gxZ8FfWO1BiKjHB7X55cz0RMFvWVGR3eRwV1wb3+yq0OXDEqh

# UhxqoNv6iYWKjkMcLhEFxvJAeNcLAyT+XdM5i2CgGPGcb95WJLiw7HzLiBKrxmDj

# 1EQB/mG5eEiRBEp7dDGzxKCnTYocDOcRr9KxqHydajmEkzXHOeRGwU+7qt8Md5l4

# bVZrXAhK+WSk5CihNQsWbzT1nRliVDwunuLkX1hyIWXIArCfrKM3+RHh+Sq5RZ8a

# Yyik2r8HxT+l2hmRllBvE2Wok6IEaAJanHr24qoqFM9WLeBUSudz+qL51HwDYyID

# PSQ3SeHtKog0ZubDk4hELQSxnfVYXdTGncaBnB60QrEuazvcob9n4yR65pUNBCF5

# qeA4QwYnilBkfnmeAjRN3LVuLr0g0FXkqfYdUmj1fFFhH8k8YBozrEaXnsSL3kdT

# D01X+4LfIWOuFzTzuoslBrBILfHNj8RfOxPgjuwNvE6YzauXi4orp4Sm6tF245Da

# FOSYbWFK5ZgG6cUY2/bUq3g3bQAqZt65KcaewEJ3ZyNEobv35Nf6xN6FrA6jF944

# 7+NHvCjeWLCQZ3M8lgeCcnnhTFtyQX3XgCoc6IRXvFOcPVrr3D9RPHCMS6Ckg8wg

# gTrtIVnY8yjbvGOUsAdZbeXUIQAWMs0d3cRDv09SvwVRd61evQIDAQABo4ICGzCC

# AhcwDgYDVR0PAQH/BAQDAgGGMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRr

# aSg6NS9IY0DPe9ivSek+2T3bITBUBgNVHSAETTBLMEkGBFUdIAAwQTA/BggrBgEF

# BQcCARYzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9Eb2NzL1JlcG9z

# aXRvcnkuaHRtMBMGA1UdJQQMMAoGCCsGAQUFBwMIMBkGCSsGAQQBgjcUAgQMHgoA

# UwB1AGIAQwBBMA8GA1UdEwEB/wQFMAMBAf8wHwYDVR0jBBgwFoAUyH7SaoUqG8oZ

# mAQHJ89QEE9oqKIwgYQGA1UdHwR9MHsweaB3oHWGc2h0dHA6Ly93d3cubWljcm9z

# b2Z0LmNvbS9wa2lvcHMvY3JsL01pY3Jvc29mdCUyMElkZW50aXR5JTIwVmVyaWZp

# Y2F0aW9uJTIwUm9vdCUyMENlcnRpZmljYXRlJTIwQXV0aG9yaXR5JTIwMjAyMC5j

# cmwwgZQGCCsGAQUFBwEBBIGHMIGEMIGBBggrBgEFBQcwAoZ1aHR0cDovL3d3dy5t

# aWNyb3NvZnQuY29tL3BraW9wcy9jZXJ0cy9NaWNyb3NvZnQlMjBJZGVudGl0eSUy

# MFZlcmlmaWNhdGlvbiUyMFJvb3QlMjBDZXJ0aWZpY2F0ZSUyMEF1dGhvcml0eSUy

# MDIwMjAuY3J0MA0GCSqGSIb3DQEBDAUAA4ICAQBfiHbHfm21WhV150x4aPpO4dhE

# mSUVpbixNDmv6TvuIHv1xIs174bNGO/ilWMm+Jx5boAXrJxagRhHQtiFprSjMktT

# liL4sKZyt2i+SXncM23gRezzsoOiBhv14YSd1Klnlkzvgs29XNjT+c8hIfPRe9rv

# VCMPiH7zPZcw5nNjthDQ+zD563I1nUJ6y59TbXWsuyUsqw7wXZoGzZwijWT5oc6G

# vD3HDokJY401uhnj3ubBhbkR83RbfMvmzdp3he2bvIUztSOuFzRqrLfEvsPkVHYn

# vH1wtYyrt5vShiKheGpXa2AWpsod4OJyT4/y0dggWi8g/tgbhmQlZqDUf3UqUQsZ

# aLdIu/XSjgoZqDjamzCPJtOLi2hBwL+KsCh0Nbwc21f5xvPSwym0Ukr4o5sCcMUc

# Sy6TEP7uMV8RX0eH/4JLEpGyae6Ki8JYg5v4fsNGif1OXHJ2IWG+7zyjTDfkmQ1s

# nFOTgyEX8qBpefQbF0fx6URrYiarjmBprwP6ZObwtZXJ23jK3Fg/9uqM3j0P01nz

# VygTppBabzxPAh/hHhhls6kwo3QLJ6No803jUsZcd4JQxiYHHc+Q/wAMcPUnYKv/

# q2O444LO1+n6j01z5mggCSlRwD9faBIySAcA9S8h22hIAcRQqIGEjolCK9F6nK9Z

# yX4lhthsGHumaABdWzCCB5cwggV/oAMCAQICEzMAAABV2d1pJij5+OIAAAAAAFUw

# DQYJKoZIhvcNAQEMBQAwYTELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29m

# dCBDb3Jwb3JhdGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0IFB1YmxpYyBSU0EgVGlt

# ZXN0YW1waW5nIENBIDIwMjAwHhcNMjUxMDIzMjA0NjQ5WhcNMjYxMDIyMjA0NjQ5

# WjCB2zELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcT

# B1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjElMCMGA1UE

# CxMcTWljcm9zb2Z0IEFtZXJpY2EgT3BlcmF0aW9uczEnMCUGA1UECxMeblNoaWVs

# ZCBUU1MgRVNOOjdEMDAtMDVFMC1EOTQ3MTUwMwYDVQQDEyxNaWNyb3NvZnQgUHVi

# bGljIFJTQSBUaW1lIFN0YW1waW5nIEF1dGhvcml0eTCCAiIwDQYJKoZIhvcNAQEB

# BQADggIPADCCAgoCggIBAL25H5IeWUiz9DAlFmn2sPymaFWbvYkMfK+ScIWb3a1I

# vOlIwghUDjY0Gp6yMRhfYURiGS0GedIB6ywvuH6VBCX3+bdOFcAclgtv21jrpOjZ

# mk4fSaT2Q3BszUfeUJa8o3xI7ZfoMY9dszTxHQAz6ZVX87fHGEVhQcfxW33IdPJO

# j/ae419qtYxT21MVmCfsTshgtWioQxmOW/vMC9/b+qgtBxSMf798vm3qfmhF6KCv

# FaHlivrM32hY16PGE3L0PFC+LM7vRxU7mTb+r76CeybvqOWk4+dbKYftPhV1t/E5

# S/6wwXeYmu/Y7JC7Tnh2w45G5Y4pcM3oHMb/YuPRdOWa0v+RC2QgmNVWqjuxDiyl

# WscXQDuaMtb29AcdGUVV9ZsRY2M2sthAtOdZOshiR5ufMtaHtiCkWv0jNfgUxrHu

# rxzYuUNneWZ6EfQDgFAw8CSCKkSOK2c9jEop4ddVq10xvbqxdrqMneVXvvIcXrPQ

# AXj9j2ECpV2EwMb3Wnmpw00P78JpzPsk3Fs61ZvOGd/F1RcOBu6f2TWdp7HL7+rq

# 7tgHr13MldbfIWu4lpoYYE1gTQa1Yrg5XN4j7zs9klT2z3qocmPzV8DWQgIHNh+a

# Ts7bujMEMQyI7Xt1zPxZCgcR6H0tmmzU/9BxvsWbRalCQ2sYGyWupTdc4e7KY7kP

# AgMBAAGjggHLMIIBxzAdBgNVHQ4EFgQUVgRfEG3cCAPwyL+pyRbKwdesZbYwHwYD

# VR0jBBgwFoAUa2koOjUvSGNAz3vYr0npPtk92yEwbAYDVR0fBGUwYzBhoF+gXYZb

# aHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0JTIw

# UHVibGljJTIwUlNBJTIwVGltZXN0YW1waW5nJTIwQ0ElMjAyMDIwLmNybDB5Bggr

# BgEFBQcBAQRtMGswaQYIKwYBBQUHMAKGXWh0dHA6Ly93d3cubWljcm9zb2Z0LmNv

# bS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwUHVibGljJTIwUlNBJTIwVGltZXN0

# YW1waW5nJTIwQ0ElMjAyMDIwLmNydDAMBgNVHRMBAf8EAjAAMBYGA1UdJQEB/wQM

# MAoGCCsGAQUFBwMIMA4GA1UdDwEB/wQEAwIHgDBmBgNVHSAEXzBdMFEGDCsGAQQB

# gjdMg30BATBBMD8GCCsGAQUFBwIBFjNodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20v

# cGtpb3BzL0RvY3MvUmVwb3NpdG9yeS5odG0wCAYGZ4EMAQQCMA0GCSqGSIb3DQEB

# DAUAA4ICAQBSHuGSVHvalCnFnlsqXIQefH1xP2SFr9g+Vz+f5P7QeywjfQb5jUlS

# md1XnJUDPe/MHxL7r3TEElL+mNtG6CDPAytStSFPXD9tTBtBMYh8Wqo64pH9qm36

# 1yIqeBH979mzWCkMQsTd0nM6dUl9B+7qiti+ToXwxIl39eYqLuYYfhD2mqqePXMz

# UKSQzkf73yYIVHP6nLJQz4aAmaWcfG9jg78sBkDV8KpW7JgktuLhphJEN1B+SVHj

# enPdcmrFXIUu/K4jK5ukfWaQIjuaXzSjBlNjC5tQN6adPfA3GxUwHPeR4ekL5If/

# 9vBf13tmzBW+gy+0sNGTveb9IL9GU8iX8UvywsX62nhCCPRUhTigDBKdczRUrNrn

# tBhowbfchBDFML8avRMRc9Gmc2JvIryX336SFQ51//q1UU2HMSJEMhWLJSIWJVhf

# UowsOa+PampIzETYfFvTu2mqKJUlWZXkGYxrdCvCczJcqeoadpW1ul6kcdnDh228

# SQ8ZhDc6IRlM4iNd5SNoNgX+aom3wuGyjUaSaPZWxPB1G2NKiYhPLt0lPHg0Gskj

# 1zhISY8UQkMMDr3o2JgRuT+wnJEDQUp55ddvhSkSoD6I9DL/s+TjIY/c9jLaW5xy

# wJHqdKHUApRMsghv7kebSua1upmR+TquelFktDSOjVdSRkuya4uoxTGCB0Mwggc/

# AgEBMHgwYTELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3Jh

# dGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0IFB1YmxpYyBSU0EgVGltZXN0YW1waW5n

# IENBIDIwMjACEzMAAABV2d1pJij5+OIAAAAAAFUwDQYJYIZIAWUDBAIBBQCgggSc

# MBEGCyqGSIb3DQEJEAIPMQIFADAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQw

# HAYJKoZIhvcNAQkFMQ8XDTI2MDUyNzExNTkwNFowLwYJKoZIhvcNAQkEMSIEILhC

# jlALgOrTOh70vi7TQSOQOj0T8fTq+PviFoKoG+yYMIG5BgsqhkiG9w0BCRACLzGB

# qTCBpjCBozCBoAQg2Lk8l2SGYru/ff7+D2qrJnkswcYdK6pGKu7GGGr4/s0wfDBl

# pGMwYTELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlv

# bjEyMDAGA1UEAxMpTWljcm9zb2Z0IFB1YmxpYyBSU0EgVGltZXN0YW1waW5nIENB

# IDIwMjACEzMAAABV2d1pJij5+OIAAAAAAFUwggNeBgsqhkiG9w0BCRACEjGCA00w

# ggNJoYIDRTCCA0EwggIpAgEBMIIBCaGB4aSB3jCB2zELMAkGA1UEBhMCVVMxEzAR

# BgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1p

# Y3Jvc29mdCBDb3Jwb3JhdGlvbjElMCMGA1UECxMcTWljcm9zb2Z0IEFtZXJpY2Eg

# T3BlcmF0aW9uczEnMCUGA1UECxMeblNoaWVsZCBUU1MgRVNOOjdEMDAtMDVFMC1E

# OTQ3MTUwMwYDVQQDEyxNaWNyb3NvZnQgUHVibGljIFJTQSBUaW1lIFN0YW1waW5n

# IEF1dGhvcml0eaIjCgEBMAcGBSsOAwIaAxUAHTtUAYJlv7bgWVeRBo4X7FeHDeqg

# ZzBlpGMwYTELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3Jh

# dGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0IFB1YmxpYyBSU0EgVGltZXN0YW1waW5n

# IENBIDIwMjAwDQYJKoZIhvcNAQELBQACBQDtwSPwMCIYDzIwMjYwNTI3MDgwNDAw

# WhgPMjAyNjA1MjgwODA0MDBaMHQwOgYKKwYBBAGEWQoEATEsMCowCgIFAO3BI/AC

# AQAwBwIBAAICAy8wBwIBAAICEvcwCgIFAO3CdXACAQAwNgYKKwYBBAGEWQoEAjEo

# MCYwDAYKKwYBBAGEWQoDAqAKMAgCAQACAwehIKEKMAgCAQACAwGGoDANBgkqhkiG

# 9w0BAQsFAAOCAQEArPByYbWgHPSt8udwq6X30Q3+PQu6DbmDK78yJ/EzScKWQw5l

# 9/HWzSuvqy69qg59ICqt0sTn+67RkDJ5TmxqMjG1YjBTt89dbexb9XCipQjvFLeT

# 6e5lpR5X9B1M1iZ7Y6wKF5iLTiJUqtdHY5t6nUAGEeMM0DeUnTRD4ARB+VUOyeNH

# 8/TfXPkwzxRGPazE2ZAT6Vyu1OpFnrHwS2zEgV0ZqmxLGIp643q6QkyM2AIOh2pe

# 3bXV4gY6jbDpSehgVJ/DDAGij1rWPtRRIo/BTsCfKKI07YspHRhhvwJ4/xdkaec+

# PnihO5rypdbsG85rezPxFYcFfVpIkMJgsjq+RDANBgkqhkiG9w0BAQEFAASCAgAd

# wcC/w1clbX4ZRjSFs5r85VzOIcieL21LDXwmQd5ryvoMdBjb+llGypRbHwxoN5kx

# M35RSSajx2iaXb22RyO1cLqBqv2p9v/+CQvB+wEHw3kevBNgnjjZzO27mTn6V+pa

# QVh/MRUyE3BgsdgIZWcWnN9gfrgJCXWev7bFkd/tFipKEtPMWGv0D57hA1PLQsi7

# x2A0upQEqO4RmoBlxjpygves9/CM5AtVnTG3QavMWuSmYmeyn30elgEDsNp5z+BL

# OvEqXXBHpPGKUr/UCGAWkxTh7RVFQPQVOpbb7HpO42SiS7xSszYDROFOv7tiuPEj

# j8ncGmmwhVnQc9y+aY2SrHTeXhDYA4/DXbNItE/1EjhYHTbCo2Fb0ys8wK7HtET6

# 2K9LY1W7OeqTk4MguS6W6wMAJtwvhWyVbpIfWIQeaQFnlTVWlUgALmPMbMb8Y7st

# gtTkZAVWgydQVu3TVAjAwqZNc1zgqsEMBdxJIYbbDBO0cHuA2mYGfXv/MY7nm1ZZ

# 9addkwP6LNWejXNfGCpRxKhsj+XWNcqcF+bV1tyCYwooSqTievx52V0ziYphq6Ov

# ape68WT/W8F2yKyqFky/K8kwkXqbIwXo7WDov2H3vUmqOyy1FM0tTnWmEIMNzcCo

# bvdEtyHNwdeXuswmgoEv8voltXH3Rq4mOP82zODcIA==

# SIG # End signature block