ScubaGear

1.8.0

Modules/Providers/ProviderHelpers/AADRiskyPermissionsHelper.psm1

                                Import-Module -Name $PSScriptRoot/../../Utility/Utility.psm1 -Function Invoke-GraphDirectly, ConvertFrom-GraphHashtable

function Get-ResourcePermissions {

    param(

        [ValidateNotNullOrEmpty()]

        [string]

        $M365Environment,

        [hashtable]

        $ResourcePermissionCache,

        [string]

        $ResourceAppId

    )

    try {

        if ($null -eq $ResourcePermissionCache) {

            $ResourcePermissionCache = @{}

        }

        if (-not $ResourcePermissionCache.ContainsKey($ResourceAppId)) {

            # v1.0 Graph endpoint is used here because it contains the oauth2PermissionScopes property

            $result = (

                Invoke-GraphDirectly `

                    -Commandlet "Get-MgServicePrincipal" `

                    -M365Environment $M365Environment `

                    -QueryParams @{

                        '$filter' = "appId eq '$ResourceAppId'"

                        '$select' = "appRoles,oauth2PermissionScopes"

                    }

            ).Value

            $ResourcePermissionCache[$ResourceAppId] = $result

        }

        return $ResourcePermissionCache[$ResourceAppId]

    }

    catch {

        Write-Warning "An error occurred in Get-ResourcePermissions: $($_.Exception.Message)"

        Write-Warning "Stack trace: $($_.ScriptStackTrace)"

        throw $_

    }

}

function Get-RiskyPermissionsJson {

    process {

        try {

            $PermissionsPath = Join-Path -Path ((Get-Item -Path $PSScriptRoot).Parent.Parent.FullName) -ChildPath "Permissions"

            $PermissionsJson = Get-Content -Path (

                Join-Path -Path (Get-Item -Path $PermissionsPath) -ChildPath "RiskyPermissions.json"

            ) | ConvertFrom-Json

        }

        catch {

            Write-Warning "An error occurred in Get-RiskyPermissionsJson: $($_.Exception.Message)"

            Write-Warning "Stack trace: $($_.ScriptStackTrace)"

            throw $_

        }

        return $PermissionsJson

    }

}

function Format-Permission {

    <#

    .Description

    Returns an API permission from either application/service principal which maps

    to the list of permissions declared in RiskyPermissions.json

    .Functionality

    #Internal

    ##>

    param (

        [ValidateNotNullOrEmpty()]

        [PSCustomObject]

        $Json,

        [ValidateNotNullOrEmpty()]

        [string]

        $AppDisplayName,

        [ValidateNotNullOrEmpty()]

        [string]

        $Id,

        [string]

        $RoleType,

        [string]

        $RoleDisplayName,

        [ValidateNotNullOrEmpty()]

        [boolean]

        $IsAdminConsented

    )

    $Map = @()

    if ( $RoleType -ne $null) {

        $RiskyPermissions = $Json.permissions.$AppDisplayName.$RoleType.PSObject.Properties.Name

        $IsRisky = $RiskyPermissions -contains $Id

        $Map += [PSCustomObject]@{

            RoleId                 = $Id

            RoleType               = if ($null -ne $RoleType) { $RoleType } else { $null }

            RoleDisplayName        = if ($null -ne $RoleDisplayName) { $RoleDisplayName } else { $null }

            ApplicationDisplayName = $AppDisplayName

            IsAdminConsented       = $IsAdminConsented

            IsRisky                = $IsRisky

        }

    }

    return $Map

}

function Format-Credentials {

    <#

    .Description

    Returns an array of valid/expired credentials

    .Functionality

    #Internal

    ##>

    [Diagnostics.CodeAnalysis.SuppressMessageAttribute(

        "PSReviewUnusedParameter", "IsFromApplication", Justification = "False positive due to variable scoping"

    )]

    param (

        [Object[]]

        $AccessKeys,

        [ValidateNotNullOrEmpty()]

        [boolean]

        $IsFromApplication

    )

    process {

        $ValidCredentials = @()

        $RequiredKeys = @("KeyId", "DisplayName", "StartDateTime", "EndDateTime")

        foreach ($Credential in $AccessKeys) {

            # Only format credentials with the correct keys

            $MissingKeys = $RequiredKeys | Where-Object { -not ($Credential.PSObject.Properties.Name -contains $_) }

            if ($MissingKeys.Count -eq 0) {

                # $Credential is of type PSCredential which is immutable, create a copy

                $CredentialCopy = $Credential | Select-Object -Property `

                    KeyId, DisplayName, StartDateTime, EndDateTime, `

                    @{ Name = "IsFromApplication"; Expression = { $IsFromApplication }}

                $ValidCredentials += $CredentialCopy

            }

        }

        if ($null -eq $AccessKeys -or $AccessKeys.Count -eq 0 -or $ValidCredentials.Count -eq 0) {

            return $null

        }

        return $ValidCredentials

    }

}

function Merge-Credentials {

    <#

    .Description

    Merge credentials from multiple resources into a single resource

    .Functionality

    #Internal

    ##>

    param (

        [Object[]]

        $ApplicationAccessKeys,

        [Object[]]

        $ServicePrincipalAccessKeys

    )

    # Both application/sp objects have key and federated credentials.

    # Conditionally merge the two together, select only application/service principal creds, or none.

    $MergedCredentials = @()

    if ($null -ne $ServicePrincipalAccessKeys -and $null -ne $ApplicationAccessKeys) {

        # Both objects valid

        $MergedCredentials = @($ServicePrincipalAccessKeys) + @($ApplicationAccessKeys)

    }

    elseif ($null -eq $ServicePrincipalAccessKeys -and $null -ne $ApplicationAccessKeys) {

        # Only application credentials valid

        $MergedCredentials = @($ApplicationAccessKeys)

    }

    elseif ($null -ne $ServicePrincipalAccessKeys -and $null -eq $ApplicationAccessKeys) {

        # Only service principal credentials valid

        $MergedCredentials = @($ServicePrincipalAccessKeys)

    }

    else {

        # Neither credentials are valid

        $MergedCredentials = $null

    }

    return $MergedCredentials

}

function Get-ApplicationsWithRiskyPermissions {

    <#

    .Description

    Returns an array of applications where each item contains its Object ID, App ID, Display Name,

    Key/Password/Federated Credentials, and risky API permissions.

    .Functionality

    #Internal

    ##>

    param (

        [ValidateNotNullOrEmpty()]

        [string]

        $M365Environment,

        [hashtable]

        $ResourcePermissionCache

    )

    process {

        try {

            $RiskyPermissionsJson = Get-RiskyPermissionsJson

            # Get all applications in the tenant

            $Applications = (Invoke-GraphDirectly -commandlet "Get-MgBetaApplication" -M365Environment $M365Environment).Value

            $ApplicationResults = @()

            foreach ($App in $Applications) {

                # `AzureADMyOrg` = single tenant; `AzureADMultipleOrgs` = multi tenant

                $IsMultiTenantEnabled = $false

                if ($App.SignInAudience -eq "AzureADMultipleOrgs") { $IsMultiTenantEnabled = $true }

                # Map application permissions against RiskyPermissions.json

                $MappedPermissions = @()

                foreach ($Resource in $App.RequiredResourceAccess) {

                    # Returns both application and delegated permissions

                    $Roles = $Resource.ResourceAccess

                    $ResourceAppId = $Resource.ResourceAppId

                    $ResourceAppPermissions = Get-ResourcePermissions `

                        -M365Environment $M365Environment `

                        -ResourcePermissionCache $ResourcePermissionCache `

                        -ResourceAppId $ResourceAppId

                    if ($null -eq $ResourceAppPermissions) {

                        Write-Warning "No permissions found for resource app ID: $ResourceAppId"

                        continue

                    }

                    # Additional processing is required to determine if a permission is admin consented.

                    # Initially assume admin consent is false since we reference the application's manifest,

                    # then update the value later when its compared to service principal permissions.

                    $IsAdminConsented = $false

                    # Only map on resources stored in RiskyPermissions.json file

                    if ($RiskyPermissionsJson.resources.PSObject.Properties.Name -contains $ResourceAppId) {

                        foreach ($Role in $Roles) {

                            $ResourceDisplayName = $RiskyPermissionsJson.resources.$ResourceAppId

                            $RoleId = $Role.Id

                            if ($Role.Type -eq "Role") {

                                $ReadableRoleType = "Application"

                                $RoleDisplayName = ($ResourceAppPermissions.appRoles | Where-Object { $_.id -eq $RoleId }).value

                            }

                            else {

                                $ReadableRoleType = "Delegated"

                                $RoleDisplayName = ($ResourceAppPermissions.oauth2PermissionScopes | Where-Object { $_.id -eq $RoleId }).value

                            }

                            $MappedPermissions += Format-Permission `

                                -Json $RiskyPermissionsJson `

                                -AppDisplayName $ResourceDisplayName `

                                -Id $RoleId `

                                -RoleType $ReadableRoleType `

                                -RoleDisplayName $RoleDisplayName `

                                -IsAdminConsented $IsAdminConsented

                        }

                    }

                }

                # Get the application credentials via Invoke-GraphDirectly

                $FederatedCredentials = (Invoke-GraphDirectly -commandlet "Get-MgBetaApplicationFederatedIdentityCredential" -M365Environment $M365Environment -Id $App.Id).Value

                $FederatedCredentialsResults = @()

                if ($FederatedCredentials -is [System.Collections.IEnumerable] -and $FederatedCredentials.Count -gt 0) {

                    foreach ($FederatedCredential in $FederatedCredentials) {

                        $FederatedCredentialsResults += [PSCustomObject]@{

                            Id          = $FederatedCredential.Id

                            Name        = $FederatedCredential.Name

                            Description = $FederatedCredential.Description

                            Issuer      = $FederatedCredential.Issuer

                            Subject     = $FederatedCredential.Subject

                            Audiences   = $FederatedCredential.Audiences | Out-String

                        }

                    }

                }

                else {

                    $FederatedCredentialsResults = $null

                }

                $RiskyPermissions = @($MappedPermissions | Where-Object { $_.IsRisky -eq $true })

                # Exclude applications without risky permissions

                if ($RiskyPermissions.Count -gt 0) {

                    $ApplicationResults += [PSCustomObject]@{

                        ObjectId             = $App.Id

                        AppId                = $App.AppId

                        DisplayName          = $App.DisplayName

                        IsMultiTenantEnabled = $IsMultiTenantEnabled

                        # Credentials from application and service principal objects may get merged in other cmdlets.

                        # Differentiate between the two by setting IsFromApplication=$true

                        KeyCredentials       = Format-Credentials -AccessKeys $App.KeyCredentials -IsFromApplication $true

                        PasswordCredentials  = Format-Credentials -AccessKeys $App.PasswordCredentials -IsFromApplication $true

                        FederatedCredentials = $FederatedCredentialsResults

                        Permissions          = $MappedPermissions

                    }

                }

            }

        } catch {

            Write-Warning "An error occurred in Get-ApplicationsWithRiskyPermissions: $($_.Exception.Message)"

            Write-Warning "Stack trace: $($_.ScriptStackTrace)"

            throw $_

        }

        return $ApplicationResults

    }

}

function Get-ServicePrincipalsWithRiskyPermissions {

    <#

    .Description

    Returns an array of service principals where each item contains its Object ID, App ID, Display Name,

    Key/Password Credentials, and risky API permissions.

    .Functionality

    #Internal

    ##>

    param (

        [ValidateNotNullOrEmpty()]

        [string]

        $M365Environment,

        [hashtable]

        $ResourcePermissionCache

    )

    process {

        try {

            $RiskyPermissionsJson = Get-RiskyPermissionsJson

            $ServicePrincipalResults = @()

            # Get all service principals

            $ServicePrincipals = (Invoke-GraphDirectly -commandlet "Get-MgBetaServicePrincipal" -M365Environment $M365Environment).Value

            # Prepare service principal IDs for batch processing

            $ServicePrincipalIds = $ServicePrincipals.Id

            # Split the service principal IDs into chunks of 20

            $Chunks = [System.Collections.Generic.List[System.Object]]::new()

            $ChunkSize = 20

            for ($i = 0; $i -lt $ServicePrincipalIds.Count; $i += $ChunkSize) {

                $Chunks.Add($ServicePrincipalIds[$i..([math]::Min($i + $ChunkSize - 1, $ServicePrincipalIds.Count - 1))])

            }

            $endpoint = '/beta/$batch'

            $endpoint = (Get-ScubaGearPermissions -CmdletName Connect-MgGraph -Environment $M365Environment -OutAs endpoint) + $endpoint

            # Process each chunk

            foreach ($Chunk in $Chunks) {

                $BatchBody = @{

                    Requests = @()

                }

                foreach ($ServicePrincipalId in $Chunk) {

                    $BatchBody.Requests += @{

                        id     = $ServicePrincipalId

                        method = "GET"

                        url    = "/servicePrincipals/$ServicePrincipalId/appRoleAssignments"

                    }

                }

                # Send the batch request

                $Response = Invoke-MgGraphRequest -Method POST -Uri $endpoint -Body (

                    $BatchBody | ConvertTo-Json -Depth 5

                )

                # Check the response

                if ($Response.responses) {

                    foreach ($Result in $Response.responses) {

                        $ServicePrincipalId = $Result.id

                        $ServicePrincipal = $ServicePrincipals | Where-Object { $_.Id -eq $ServicePrincipalId }

                        $MappedPermissions = @()

                        if ($Result.status -eq 200) {

                            $AppRoleAssignments = $Result.body.value

                            if ($AppRoleAssignments.Count -gt 0) {

                                foreach ($Role in $AppRoleAssignments) {

                                    $ResourceDisplayName = $Role.ResourceDisplayName

                                    $RoleId = $Role.AppRoleId

                                    # Default to true,

                                    # `Get-MgBetaServicePrincipalAppRoleAssignment` only returns admin consented permissions

                                    $IsAdminConsented = $true

                                    # Only map on resources stored in RiskyPermissions.json file

                                    if ($RiskyPermissionsJson.permissions.PSObject.Properties.Name -contains $ResourceDisplayName) {

                                        $ResourceAppId = $RiskyPermissionsJson.resources.PSObject.Properties | Where-Object {

                                            $_.Value -eq $ResourceDisplayName

                                        } | Select-Object -ExpandProperty Name

                                        $ResourceAppPermissions = Get-ResourcePermissions `

                                            -M365Environment $M365Environment `

                                            -ResourcePermissionCache $ResourcePermissionCache `

                                            -ResourceAppId $ResourceAppId

                                        if ($null -eq $ResourceAppPermissions) {

                                            Write-Warning "No permissions found for resource app ID: $ResourceAppId"

                                            continue

                                        }

                                        $ReadableRoleType = $null

                                        $RoleDisplayName = $null

                                        $AppRole = $ResourceAppPermissions.appRoles | Where-Object { $_.id -eq $RoleId }

                                        if ($null -ne $AppRole) {

                                            $ReadableRoleType = "Application"

                                            $RoleDisplayName = $AppRole.value

                                        }

                                        else {

                                            $OauthScope = $ResourceAppPermissions.oauth2PermissionScopes | Where-Object { $_.id -eq $RoleId }

                                            if ($null -ne $OauthScope) {

                                                $ReadableRoleType = "Delegated"

                                                $RoleDisplayName = $OauthScope.value

                                            }

                                        }

                                        $MappedPermissions += Format-Permission `

                                            -Json $RiskyPermissionsJson `

                                            -AppDisplayName $ResourceDisplayName `

                                            -Id $RoleId `

                                            -RoleType $ReadableRoleType `

                                            -RoleDisplayName $RoleDisplayName `

                                            -IsAdminConsented $IsAdminConsented

                                    }

                                }

                            }

                        } else {

                            Write-Warning "Error for service principal $($Result.id): $($Result.status)"

                        }

                        $RiskyPermissions = @($MappedPermissions | Where-Object { $_.IsRisky -eq $true })

                        # Exclude service principals without risky permissions

                        if ($RiskyPermissions.Count -gt 0) {

                            $ServicePrincipalResults += [PSCustomObject]@{

                                ObjectId                = $ServicePrincipal.Id

                                AppId                   = $ServicePrincipal.AppId

                                DisplayName             = $ServicePrincipal.DisplayName

                                SignInAudience          = $ServicePrincipal.SignInAudience

                                # Credentials from application and service principal objects may get merged in other cmdlets.

                                # Differentiate between the two by setting IsFromApplication=$false

                                KeyCredentials          = Format-Credentials -AccessKeys $ServicePrincipal.KeyCredentials -IsFromApplication $false

                                PasswordCredentials     = Format-Credentials -AccessKeys $ServicePrincipal.PasswordCredentials -IsFromApplication $false

                                FederatedCredentials    = $ServicePrincipal.FederatedIdentityCredentials

                                Permissions             = $MappedPermissions

                                AppOwnerOrganizationId  = $ServicePrincipal.AppOwnerOrganizationId

                            }

                        }

                    }

                }

            }

        } catch {

            Write-Warning "An error occurred in Get-ServicePrincipalsWithRiskyPermissions: $($_.Exception.Message)"

            Write-Warning "Stack trace: $($_.ScriptStackTrace)"

            throw $_

        }

        return $ServicePrincipalResults

    }

}

function Format-RiskyApplications {

    <#

    .Description

    Returns an aggregated JSON dataset of application objects, combining data from both applications and

    service principal objects. Key/Password/Federated credentials are combined into a single array, and

    admin consent is reflected in each object's list of associated risky permissions.

    .Functionality

    #Internal

    ##>

    param (

        [ValidateNotNullOrEmpty()]

        [Object[]]

        $RiskyApps,

        [ValidateNotNullOrEmpty()]

        [Object[]]

        $RiskySPs

    )

    process {

        try {

            $Applications = @()

            foreach ($App in $RiskyApps) {

                $MatchedServicePrincipal = $RiskySPs | Where-Object { $_.AppId -eq $App.AppId }

                # Merge objects if an application and service principal exist with the same AppId

                $MergedObject = @{}

                if ($MatchedServicePrincipal) {

                    # Determine if each risky permission was admin consented or not

                    foreach ($Permission in $App.Permissions) {

                        $ServicePrincipalRoleIds = $MatchedServicePrincipal.Permissions | Select-Object -ExpandProperty RoleId

                        if ($ServicePrincipalRoleIds -contains $Permission.RoleId) {

                            $Permission.IsAdminConsented = $true

                        }

                    }

                    $ObjectIds = [PSCustomObject]@{

                        Application      = $App.ObjectId

                        ServicePrincipal = $MatchedServicePrincipal.ObjectId

                    }

                    $MergedKeyCredentials = Merge-Credentials `

                        -ApplicationAccessKeys $App.KeyCredentials `

                        -ServicePrincipalAccessKeys $MatchedServicePrincipal.KeyCredentials

                    $MergedPasswordCredentials = Merge-Credentials `

                        -ApplicationAccessKeys $App.PasswordCredentials `

                        -ServicePrincipalAccessKeys $MatchedServicePrincipal.PasswordCredentials

                    $MergedFederatedCredentials = Merge-Credentials `

                        -ApplicationAccessKeys $App.FederatedCredentials `

                        -ServicePrincipalAccessKeys $MatchedServicePrincipal.FederatedCredentials

                    $MergedObject = [PSCustomObject]@{

                        ObjectId                 = $ObjectIds

                        AppId                    = $App.AppId

                        DisplayName              = $App.DisplayName

                        IsMultiTenantEnabled     = $App.IsMultiTenantEnabled

                        KeyCredentials           = $MergedKeyCredentials

                        PasswordCredentials      = $MergedPasswordCredentials

                        FederatedCredentials     = $MergedFederatedCredentials

                        Permissions              = $App.Permissions

                    }

                }

                else {

                    $MergedObject = $App

                }

                $Applications += $MergedObject

            }

        }

        catch {

            Write-Warning "An error occurred in Format-RiskyApplications: $($_.Exception.Message)"

            Write-Warning "Stack trace: $($_.ScriptStackTrace)"

            throw $_

        }

        return $Applications

    }

}

function Format-RiskyThirdPartyServicePrincipals {

    <#

    .Description

    Returns a JSON dataset of service principal objects owned by external organizations.

    .Functionality

    #Internal

    ##>

    param (

        [ValidateNotNullOrEmpty()]

        [Object[]]

        $RiskySPs,

        [ValidateNotNullOrEmpty()]

        [string]

        $M365Environment

    )

    process {

        try {

            $ServicePrincipals = @()

            $OrgInfo = (Invoke-GraphDirectly -Commandlet "Get-MgBetaOrganization" -M365Environment $M365Environment).Value

            foreach ($ServicePrincipal in $RiskySPs) {

                if ($null -eq $ServicePrincipal) {

                    continue

                }

                # If the service principal's owner id is not the same as this tenant then it is a 3rd party principal

                if ($ServicePrincipal.AppOwnerOrganizationId -ne $OrgInfo.Id) {

                    $ServicePrincipals += $ServicePrincipal

                }

            }

        }

        catch {

            Write-Warning "An error occurred in Format-RiskyThirdPartyServicePrincipals: $($_.Exception.Message)"

            Write-Warning "Stack trace: $($_.ScriptStackTrace)"

            throw $_

        }

        return $ServicePrincipals

    }

}

Export-ModuleMember -Function @(

    "Get-RiskyPermissionsJson",

    "Format-Credentials",

    "Get-ApplicationsWithRiskyPermissions",

    "Get-ServicePrincipalsWithRiskyPermissions",

    "Format-RiskyApplications",

    "Format-RiskyThirdPartyServicePrincipals"

)

# SIG # Begin signature block

# MIIu9gYJKoZIhvcNAQcCoIIu5zCCLuMCAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBSuOaGQxAbnbqR

# GshF4GlTEyPApqH0FPwcqu2JNcJdzqCCE6MwggWQMIIDeKADAgECAhAFmxtXno4h

# MuI5B72nd3VcMA0GCSqGSIb3DQEBDAUAMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQK

# EwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNV

# BAMTGERpZ2lDZXJ0IFRydXN0ZWQgUm9vdCBHNDAeFw0xMzA4MDExMjAwMDBaFw0z

# ODAxMTUxMjAwMDBaMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJ

# bmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0

# IFRydXN0ZWQgUm9vdCBHNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB

# AL/mkHNo3rvkXUo8MCIwaTPswqclLskhPfKK2FnC4SmnPVirdprNrnsbhA3EMB/z

# G6Q4FutWxpdtHauyefLKEdLkX9YFPFIPUh/GnhWlfr6fqVcWWVVyr2iTcMKyunWZ

# anMylNEQRBAu34LzB4TmdDttceItDBvuINXJIB1jKS3O7F5OyJP4IWGbNOsFxl7s

# Wxq868nPzaw0QF+xembud8hIqGZXV59UWI4MK7dPpzDZVu7Ke13jrclPXuU15zHL

# 2pNe3I6PgNq2kZhAkHnDeMe2scS1ahg4AxCN2NQ3pC4FfYj1gj4QkXCrVYJBMtfb

# BHMqbpEBfCFM1LyuGwN1XXhm2ToxRJozQL8I11pJpMLmqaBn3aQnvKFPObURWBf3

# JFxGj2T3wWmIdph2PVldQnaHiZdpekjw4KISG2aadMreSx7nDmOu5tTvkpI6nj3c

# AORFJYm2mkQZK37AlLTSYW3rM9nF30sEAMx9HJXDj/chsrIRt7t/8tWMcCxBYKqx

# YxhElRp2Yn72gLD76GSmM9GJB+G9t+ZDpBi4pncB4Q+UDCEdslQpJYls5Q5SUUd0

# viastkF13nqsX40/ybzTQRESW+UQUOsxxcpyFiIJ33xMdT9j7CFfxCBRa2+xq4aL

# T8LWRV+dIPyhHsXAj6KxfgommfXkaS+YHS312amyHeUbAgMBAAGjQjBAMA8GA1Ud

# EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMB0GA1UdDgQWBBTs1+OC0nFdZEzf

# Lmc/57qYrhwPTzANBgkqhkiG9w0BAQwFAAOCAgEAu2HZfalsvhfEkRvDoaIAjeNk

# aA9Wz3eucPn9mkqZucl4XAwMX+TmFClWCzZJXURj4K2clhhmGyMNPXnpbWvWVPjS

# PMFDQK4dUPVS/JA7u5iZaWvHwaeoaKQn3J35J64whbn2Z006Po9ZOSJTROvIXQPK

# 7VB6fWIhCoDIc2bRoAVgX+iltKevqPdtNZx8WorWojiZ83iL9E3SIAveBO6Mm0eB

# cg3AFDLvMFkuruBx8lbkapdvklBtlo1oepqyNhR6BvIkuQkRUNcIsbiJeoQjYUIp

# 5aPNoiBB19GcZNnqJqGLFNdMGbJQQXE9P01wI4YMStyB0swylIQNCAmXHE/A7msg

# dDDS4Dk0EIUhFQEI6FUy3nFJ2SgXUE3mvk3RdazQyvtBuEOlqtPDBURPLDab4vri

# RbgjU2wGb2dVf0a1TD9uKFp5JtKkqGKX0h7i7UqLvBv9R0oN32dmfrJbQdA75PQ7

# 9ARj6e/CVABRoIoqyc54zNXqhwQYs86vSYiv85KZtrPmYQ/ShQDnUBrkG5WdGaG5

# nLGbsQAe79APT0JsyQq87kP6OnGlyE0mpTX9iV28hWIdMtKgK1TtmlfB2/oQzxm3

# i0objwG2J5VT6LaJbVu8aNQj6ItRolb58KaAoNYes7wPD1N1KarqE3fk3oyBIa0H

# EEcRrYc9B9F1vM/zZn4wggawMIIEmKADAgECAhAIrUCyYNKcTJ9ezam9k67ZMA0G

# CSqGSIb3DQEBDAUAMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJ

# bmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0

# IFRydXN0ZWQgUm9vdCBHNDAeFw0yMTA0MjkwMDAwMDBaFw0zNjA0MjgyMzU5NTla

# MGkxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjFBMD8GA1UE

# AxM4RGlnaUNlcnQgVHJ1c3RlZCBHNCBDb2RlIFNpZ25pbmcgUlNBNDA5NiBTSEEz

# ODQgMjAyMSBDQTEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDVtC9C

# 0CiteLdd1TlZG7GIQvUzjOs9gZdwxbvEhSYwn6SOaNhc9es0JAfhS0/TeEP0F9ce

# 2vnS1WcaUk8OoVf8iJnBkcyBAz5NcCRks43iCH00fUyAVxJrQ5qZ8sU7H/Lvy0da

# E6ZMswEgJfMQ04uy+wjwiuCdCcBlp/qYgEk1hz1RGeiQIXhFLqGfLOEYwhrMxe6T

# SXBCMo/7xuoc82VokaJNTIIRSFJo3hC9FFdd6BgTZcV/sk+FLEikVoQ11vkunKoA

# FdE3/hoGlMJ8yOobMubKwvSnowMOdKWvObarYBLj6Na59zHh3K3kGKDYwSNHR7Oh

# D26jq22YBoMbt2pnLdK9RBqSEIGPsDsJ18ebMlrC/2pgVItJwZPt4bRc4G/rJvmM

# 1bL5OBDm6s6R9b7T+2+TYTRcvJNFKIM2KmYoX7BzzosmJQayg9Rc9hUZTO1i4F4z

# 8ujo7AqnsAMrkbI2eb73rQgedaZlzLvjSFDzd5Ea/ttQokbIYViY9XwCFjyDKK05

# huzUtw1T0PhH5nUwjewwk3YUpltLXXRhTT8SkXbev1jLchApQfDVxW0mdmgRQRNY

# mtwmKwH0iU1Z23jPgUo+QEdfyYFQc4UQIyFZYIpkVMHMIRroOBl8ZhzNeDhFMJlP

# /2NPTLuqDQhTQXxYPUez+rbsjDIJAsxsPAxWEQIDAQABo4IBWTCCAVUwEgYDVR0T

# AQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHwYD

# VR0jBBgwFoAU7NfjgtJxXWRM3y5nP+e6mK4cD08wDgYDVR0PAQH/BAQDAgGGMBMG

# A1UdJQQMMAoGCCsGAQUFBwMDMHcGCCsGAQUFBwEBBGswaTAkBggrBgEFBQcwAYYY

# aHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEEGCCsGAQUFBzAChjVodHRwOi8vY2Fj

# ZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNydDBDBgNV

# HR8EPDA6MDigNqA0hjJodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRU

# cnVzdGVkUm9vdEc0LmNybDAcBgNVHSAEFTATMAcGBWeBDAEDMAgGBmeBDAEEATAN

# BgkqhkiG9w0BAQwFAAOCAgEAOiNEPY0Idu6PvDqZ01bgAhql+Eg08yy25nRm95Ry

# sQDKr2wwJxMSnpBEn0v9nqN8JtU3vDpdSG2V1T9J9Ce7FoFFUP2cvbaF4HZ+N3HL

# IvdaqpDP9ZNq4+sg0dVQeYiaiorBtr2hSBh+3NiAGhEZGM1hmYFW9snjdufE5Btf

# Q/g+lP92OT2e1JnPSt0o618moZVYSNUa/tcnP/2Q0XaG3RywYFzzDaju4ImhvTnh

# OE7abrs2nfvlIVNaw8rpavGiPttDuDPITzgUkpn13c5UbdldAhQfQDN8A+KVssIh

# dXNSy0bYxDQcoqVLjc1vdjcshT8azibpGL6QB7BDf5WIIIJw8MzK7/0pNVwfiThV

# 9zeKiwmhywvpMRr/LhlcOXHhvpynCgbWJme3kuZOX956rEnPLqR0kq3bPKSchh/j

# wVYbKyP/j7XqiHtwa+aguv06P0WmxOgWkVKLQcBIhEuWTatEQOON8BUozu3xGFYH

# Ki8QxAwIZDwzj64ojDzLj4gLDb879M4ee47vtevLt/B3E+bnKD+sEq6lLyJsQfmC

# XBVmzGwOysWGw/YmMwwHS6DTBwJqakAwSEs0qFEgu60bhQjiWQ1tygVQK+pKHJ6l

# /aCnHwZ05/LWUpD9r4VIIflXO7ScA+2GRfS0YW6/aOImYIbqyK+p/pQd52MbOoZW

# eE4wggdXMIIFP6ADAgECAhAMM6tnPejLgA9WVhXroQvSMA0GCSqGSIb3DQEBCwUA

# MGkxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjFBMD8GA1UE

# AxM4RGlnaUNlcnQgVHJ1c3RlZCBHNCBDb2RlIFNpZ25pbmcgUlNBNDA5NiBTSEEz

# ODQgMjAyMSBDQTEwHhcNMjYwMTE0MDAwMDAwWhcNMjcwMTEzMjM1OTU5WjBfMQsw

# CQYDVQQGEwJVUzEdMBsGA1UECBMURGlzdHJpY3Qgb2YgQ29sdW1iaWExEzARBgNV

# BAcTCldhc2hpbmd0b24xDTALBgNVBAoTBENJU0ExDTALBgNVBAMTBENJU0EwggIi

# MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCuXYolNHqlh6smLTE592waXheZ

# 8VHzxeds4pMaepGuwmjf8d1jG9wUNuJX9/qb0a1dgGz5D/EAz5NRTIin4SZYQEE8

# qvdl2yQJ5uWxXIjsFbrOyc1fWscUXw0Kt7OPLOafcEkdDoe8K0tO4h2GL3RWRzjp

# uLfQhhnAmD6NT1l+ughnfmarV/ODgIn/RFR4YORlu4YP2xQX6KRxeTDslg7F+z6X

# +t87/U8m8gQ9XTm5kBmteP4GcE/ytnyI+ScIxNRybzGomWIBm848XDE5yYhlYQ2R

# SnCoo6M4CRqp9WFGVyoLkoPP0OlxzryKWaE1/nuPbYG/kf/rUB1OhqxvSSGwmNhs

# vkkjsC0Z9H5Jy6heFdoxOu/+ZQksKoP/fMvHxuCCtkIJbV8tk0oT6MQ8EJbgsWDZ

# TKhui1wxW6JIZyBOMPWoZUOouOzo2h5Cz7LBPKME5FkcUzcs47lpRlDkJco4PLcj

# wJSo4XPnx3G/2DIjNEFNyfKCWfH8uW6nJjmDBiveFZ2j0YvgdQ+7MOjQnw7R/MAD

# DTagrKl3rLV60+X2TY6/onKhCUuU3pMAjVbOwZ3PkzDLZnsEGRfm6hgp6014aXml

# t8h4nu+uC41U8vUSGHl0vqKuzvmShLmnI+Iv0l95pmnqomuCZzRDrjEoaLPx7OxL

# Dy/Id9E7yQDip4jBdQIDAQABo4ICAzCCAf8wHwYDVR0jBBgwFoAUaDfg67Y7+F8R

# hvv+YXsIiGX0TkIwHQYDVR0OBBYEFN30sVU+fpfQQfPQWMhkO1qd+MxoMD4GA1Ud

# IAQ3MDUwMwYGZ4EMAQQBMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNl

# cnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMw

# gbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0Rp

# Z2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5j

# cmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0

# ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMIGUBggrBgEF

# BQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29t

# MFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNl

# cnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNydDAJ

# BgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQA77T42YiOx5wWPItgo+kvB+Gzb

# ZFCRHRFfTAZZNQt9o/0CqNmyA2xFklX4t5Z9VNdiIOx14AnmJdQkcRdk3vsU5gby

# jKEup7LTWtvcWrl6hQwGNt3l892BgUbPKsPBE+AriktVqn5yMSXVVzeboqsqAG8e

# Syei0B54/QdgR4whfHvQ/qpCACsJTlJgAykXVgDPJNKnQ7wc17loLQutqF1JUcbO

# XKWt1AA9Zas5q30LDZzZeK4B56yojK68CTQXN7toSRFIuZDMKKDfIZpCX8cmbaaO

# DFOOu44/QWMv+Xc6+ISYGkrTTzqWhOqiXgLVBeXGn/WrOJJ8R29mZMneCpBesCLs

# YII1gCFOo7Vt6mvOKxAPQ3KhJYBFEHkp+GI65koaQkO2xv50iLS0+/j2YC66uviU

# MFe0JEOdXuE7Rn/OmWNSzQ+6kPNYDJQASQ974C3wUejJoMtGZEzoTbly/HufQTrd

# rhcL2aC69CxSN+idTXPLC9UT3xo4sFdOw+hXkmbXtoB1GDsd5p1TWFgRbnTXDkbM

# YMBWYVB6/Tk1bzwj4iTp4g0YrtB628FXPX/ko+JWZlv0Ea865S23w1uGlnDNVxIi

# +8oi74G5DM66Q6ENt6+3WoRGRrdoyE6uCh1haY+oPYSgumb0ozzrp8tw89TRKVrK

# KSXGBxlExEvjQ6dYwjGCGqkwghqlAgEBMH0waTELMAkGA1UEBhMCVVMxFzAVBgNV

# BAoTDkRpZ2lDZXJ0LCBJbmMuMUEwPwYDVQQDEzhEaWdpQ2VydCBUcnVzdGVkIEc0

# IENvZGUgU2lnbmluZyBSU0E0MDk2IFNIQTM4NCAyMDIxIENBMQIQDDOrZz3oy4AP

# VlYV66EL0jANBglghkgBZQMEAgEFAKCBhDAYBgorBgEEAYI3AgEMMQowCKACgACh

# AoAAMBkGCSqGSIb3DQEJAzEMBgorBgEEAYI3AgEEMBwGCisGAQQBgjcCAQsxDjAM

# BgorBgEEAYI3AgEVMC8GCSqGSIb3DQEJBDEiBCC+5XHXm/ZgUfYoqgW/l+d1OSlT

# G4YVIGVpqgwvlMfVkjANBgkqhkiG9w0BAQEFAASCAgAswsrxX406a7ywpCnT6sHh

# P6AFplZ9J6D6cNJ3GsBK6u97UQ70TX1qIvTmMiNXnQUpQLG4IEV98tawsJv/hiIc

# JxblkJ0sHGdFDKqgCgyjQUUVmaWOJ6g4g8pnxr1/PnLUgQ4Zfa4CobEeDNAoBQQJ

# iEH42oT0KdY+t0mykNIFNIfOzmOls7RPFRktjvotXTc82I9OLauGHTLNdCOjlrtM

# 6yPWoCzQtGtfJ5XAqQiThuKLsiMom2rzPXWlg3J/4VirUPY0OtJNlQrRXa1fJ+gT

# qWTgrmGT5E27eUerOgbDpk2t0xKB6j1xEeVSNNM8wGMqaUESlIYoGzREzPQhJfmn

# HB8tzoV1kJnD3G1cI9PIFdPaMmFbCdSA3Gzv5Lc8tMZuySHN9p1EYCkXuIefIVkU

# uE0cdK9GwvM/34kk3ry7rkYoRa2fGwIUnyUxYNFj0+6zfD+gNFIlcc9ihqyP9ZEc

# 5CRdqZilQcrtvaaVtlOPBSSOmp07UN8sscAAWOJAbks04MmYqI2G7oEIQQVXGUgv

# W+MnYfZ/UNeHc6PzOvs76irt95JhS43qZ6Y/uZLvPoCJeYZA/+bqmUY2mWN3eEkh

# 1BM3efvMVQbFk6GjTUek44N0e3f+ssTCPanaru80vmYX8Wwp7RqTORLAn1o2HESD

# 8MJnr567Fz37hk7i7FaSeqGCF3YwghdyBgorBgEEAYI3AwMBMYIXYjCCF14GCSqG

# SIb3DQEHAqCCF08wghdLAgEDMQ8wDQYJYIZIAWUDBAIBBQAwdwYLKoZIhvcNAQkQ

# AQSgaARmMGQCAQEGCWCGSAGG/WwHATAxMA0GCWCGSAFlAwQCAQUABCAnFMdqEGZV

# Mk1+f7AiZxDlN5WkQvwu9cwLqYxoQmHRGQIQZ2WLra6icaNedEnPlu+TaRgPMjAy

# NjA1MDcyMTQ2NTBaoIITOjCCBu0wggTVoAMCAQICEAqA7xhLjfEFgtHEdqeVdGgw

# DQYJKoZIhvcNAQELBQAwaTELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDkRpZ2lDZXJ0

# LCBJbmMuMUEwPwYDVQQDEzhEaWdpQ2VydCBUcnVzdGVkIEc0IFRpbWVTdGFtcGlu

# ZyBSU0E0MDk2IFNIQTI1NiAyMDI1IENBMTAeFw0yNTA2MDQwMDAwMDBaFw0zNjA5

# MDMyMzU5NTlaMGMxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5j

# LjE7MDkGA1UEAxMyRGlnaUNlcnQgU0hBMjU2IFJTQTQwOTYgVGltZXN0YW1wIFJl

# c3BvbmRlciAyMDI1IDEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDQ

# RqwtEsae0OquYFazK1e6b1H/hnAKAd/KN8wZQjBjMqiZ3xTWcfsLwOvRxUwXcGx8

# AUjni6bz52fGTfr6PHRNv6T7zsf1Y/E3IU8kgNkeECqVQ+3bzWYesFtkepErvUSb

# f+EIYLkrLKd6qJnuzK8Vcn0DvbDMemQFoxQ2Dsw4vEjoT1FpS54dNApZfKY61HAl

# dytxNM89PZXUP/5wWWURK+IfxiOg8W9lKMqzdIo7VA1R0V3Zp3DjjANwqAf4lEkT

# lCDQ0/fKJLKLkzGBTpx6EYevvOi7XOc4zyh1uSqgr6UnbksIcFJqLbkIXIPbcNmA

# 98Oskkkrvt6lPAw/p4oDSRZreiwB7x9ykrjS6GS3NR39iTTFS+ENTqW8m6THuOmH

# HjQNC3zbJ6nJ6SXiLSvw4Smz8U07hqF+8CTXaETkVWz0dVVZw7knh1WZXOLHgDvu

# ndrAtuvz0D3T+dYaNcwafsVCGZKUhQPL1naFKBy1p6llN3QgshRta6Eq4B40h5av

# Mcpi54wm0i2ePZD5pPIssoszQyF4//3DoK2O65Uck5Wggn8O2klETsJ7u8xEehGi

# fgJYi+6I03UuT1j7FnrqVrOzaQoVJOeeStPeldYRNMmSF3voIgMFtNGh86w3ISHN

# m0IaadCKCkUe2LnwJKa8TIlwCUNVwppwn4D3/Pt5pwIDAQABo4IBlTCCAZEwDAYD

# VR0TAQH/BAIwADAdBgNVHQ4EFgQU5Dv88jHt/f3X85FxYxlQQ89hjOgwHwYDVR0j

# BBgwFoAU729TSunkBnx6yuKQVvYv1Ensy04wDgYDVR0PAQH/BAQDAgeAMBYGA1Ud

# JQEB/wQMMAoGCCsGAQUFBwMIMIGVBggrBgEFBQcBAQSBiDCBhTAkBggrBgEFBQcw

# AYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMF0GCCsGAQUFBzAChlFodHRwOi8v

# Y2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRUaW1lU3RhbXBp

# bmdSU0E0MDk2U0hBMjU2MjAyNUNBMS5jcnQwXwYDVR0fBFgwVjBUoFKgUIZOaHR0

# cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0VGltZVN0YW1w

# aW5nUlNBNDA5NlNIQTI1NjIwMjVDQTEuY3JsMCAGA1UdIAQZMBcwCAYGZ4EMAQQC

# MAsGCWCGSAGG/WwHATANBgkqhkiG9w0BAQsFAAOCAgEAZSqt8RwnBLmuYEHs0QhE

# nmNAciH45PYiT9s1i6UKtW+FERp8FgXRGQ/YAavXzWjZhY+hIfP2JkQ38U+wtJPB

# VBajYfrbIYG+Dui4I4PCvHpQuPqFgqp1PzC/ZRX4pvP/ciZmUnthfAEP1HShTrY+

# 2DE5qjzvZs7JIIgt0GCFD9ktx0LxxtRQ7vllKluHWiKk6FxRPyUPxAAYH2Vy1lNM

# 4kzekd8oEARzFAWgeW3az2xejEWLNN4eKGxDJ8WDl/FQUSntbjZ80FU3i54tpx5F

# /0Kr15zW/mJAxZMVBrTE2oi0fcI8VMbtoRAmaaslNXdCG1+lqvP4FbrQ6IwSBXkZ

# agHLhFU9HCrG/syTRLLhAezu/3Lr00GrJzPQFnCEH1Y58678IgmfORBPC1JKkYaE

# t2OdDh4GmO0/5cHelAK2/gTlQJINqDr6JfwyYHXSd+V08X1JUPvB4ILfJdmL+66G

# p3CSBXG6IwXMZUXBhtCyIaehr0XkBoDIGMUG1dUtwq1qmcwbdUfcSYCn+OwncVUX

# f53VJUNOaMWMts0VlRYxe5nK+At+DI96HAlXHAL5SlfYxJ7La54i71McVWRP66bW

# +yERNpbJCjyCYG2j+bdpxo/1Cy4uPcU3AWVPGrbn5PhDBf3Froguzzhk++ami+r3

# Qrx5bIbY3TVzgiFI7Gq3zWcwgga0MIIEnKADAgECAhANx6xXBf8hmS5AQyIMOkmG

# MA0GCSqGSIb3DQEBCwUAMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2Vy

# dCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lD

# ZXJ0IFRydXN0ZWQgUm9vdCBHNDAeFw0yNTA1MDcwMDAwMDBaFw0zODAxMTQyMzU5

# NTlaMGkxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjFBMD8G

# A1UEAxM4RGlnaUNlcnQgVHJ1c3RlZCBHNCBUaW1lU3RhbXBpbmcgUlNBNDA5NiBT

# SEEyNTYgMjAyNSBDQTEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC0

# eDHTCphBcr48RsAcrHXbo0ZodLRRF51NrY0NlLWZloMsVO1DahGPNRcybEKq+Ruw

# OnPhof6pvF4uGjwjqNjfEvUi6wuim5bap+0lgloM2zX4kftn5B1IpYzTqpyFQ/4B

# t0mAxAHeHYNnQxqXmRinvuNgxVBdJkf77S2uPoCj7GH8BLuxBG5AvftBdsOECS1U

# kxBvMgEdgkFiDNYiOTx4OtiFcMSkqTtF2hfQz3zQSku2Ws3IfDReb6e3mmdglTca

# arps0wjUjsZvkgFkriK9tUKJm/s80FiocSk1VYLZlDwFt+cVFBURJg6zMUjZa/zb

# CclF83bRVFLeGkuAhHiGPMvSGmhgaTzVyhYn4p0+8y9oHRaQT/aofEnS5xLrfxnG

# pTXiUOeSLsJygoLPp66bkDX1ZlAeSpQl92QOMeRxykvq6gbylsXQskBBBnGy3tW/

# AMOMCZIVNSaz7BX8VtYGqLt9MmeOreGPRdtBx3yGOP+rx3rKWDEJlIqLXvJWnY0v

# 5ydPpOjL6s36czwzsucuoKs7Yk/ehb//Wx+5kMqIMRvUBDx6z1ev+7psNOdgJMoi

# wOrUG2ZdSoQbU2rMkpLiQ6bGRinZbI4OLu9BMIFm1UUl9VnePs6BaaeEWvjJSjNm

# 2qA+sdFUeEY0qVjPKOWug/G6X5uAiynM7Bu2ayBjUwIDAQABo4IBXTCCAVkwEgYD

# VR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU729TSunkBnx6yuKQVvYv1Ensy04w

# HwYDVR0jBBgwFoAU7NfjgtJxXWRM3y5nP+e6mK4cD08wDgYDVR0PAQH/BAQDAgGG

# MBMGA1UdJQQMMAoGCCsGAQUFBwMIMHcGCCsGAQUFBwEBBGswaTAkBggrBgEFBQcw

# AYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEEGCCsGAQUFBzAChjVodHRwOi8v

# Y2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNydDBD

# BgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNl

# cnRUcnVzdGVkUm9vdEc0LmNybDAgBgNVHSAEGTAXMAgGBmeBDAEEAjALBglghkgB

# hv1sBwEwDQYJKoZIhvcNAQELBQADggIBABfO+xaAHP4HPRF2cTC9vgvItTSmf83Q

# h8WIGjB/T8ObXAZz8OjuhUxjaaFdleMM0lBryPTQM2qEJPe36zwbSI/mS83afsl3

# YTj+IQhQE7jU/kXjjytJgnn0hvrV6hqWGd3rLAUt6vJy9lMDPjTLxLgXf9r5nWMQ

# wr8Myb9rEVKChHyfpzee5kH0F8HABBgr0UdqirZ7bowe9Vj2AIMD8liyrukZ2iA/

# wdG2th9y1IsA0QF8dTXqvcnTmpfeQh35k5zOCPmSNq1UH410ANVko43+Cdmu4y81

# hjajV/gxdEkMx1NKU4uHQcKfZxAvBAKqMVuqte69M9J6A47OvgRaPs+2ykgcGV00

# TYr2Lr3ty9qIijanrUR3anzEwlvzZiiyfTPjLbnFRsjsYg39OlV8cipDoq7+qNNj

# qFzeGxcytL5TTLL4ZaoBdqbhOhZ3ZRDUphPvSRmMThi0vw9vODRzW6AxnJll38F0

# cuJG7uEBYTptMSbhdhGQDpOXgpIUsWTjd6xpR6oaQf/DJbg3s6KCLPAlZ66RzIg9

# sC+NJpud/v4+7RWsWCiKi9EOLLHfMR2ZyJ/+xhCx9yHbxtl5TPau1j/1MIDpMPx0

# LckTetiSuEtQvLsNz3Qbp7wGWqbIiOWCnb5WqxL3/BAPvIXKUjPSxyZsq8WhbaM2

# tszWkPZPubdcMIIFjTCCBHWgAwIBAgIQDpsYjvnQLefv21DiCEAYWjANBgkqhkiG

# 9w0BAQwFADBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkw

# FwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1

# cmVkIElEIFJvb3QgQ0EwHhcNMjIwODAxMDAwMDAwWhcNMzExMTA5MjM1OTU5WjBi

# MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3

# d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3Qg

# RzQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC/5pBzaN675F1KPDAi

# MGkz7MKnJS7JIT3yithZwuEppz1Yq3aaza57G4QNxDAf8xukOBbrVsaXbR2rsnny

# yhHS5F/WBTxSD1Ifxp4VpX6+n6lXFllVcq9ok3DCsrp1mWpzMpTREEQQLt+C8weE

# 5nQ7bXHiLQwb7iDVySAdYyktzuxeTsiT+CFhmzTrBcZe7FsavOvJz82sNEBfsXpm

# 7nfISKhmV1efVFiODCu3T6cw2Vbuyntd463JT17lNecxy9qTXtyOj4DatpGYQJB5

# w3jHtrHEtWoYOAMQjdjUN6QuBX2I9YI+EJFwq1WCQTLX2wRzKm6RAXwhTNS8rhsD

# dV14Ztk6MUSaM0C/CNdaSaTC5qmgZ92kJ7yhTzm1EVgX9yRcRo9k98FpiHaYdj1Z

# XUJ2h4mXaXpI8OCiEhtmmnTK3kse5w5jrubU75KSOp493ADkRSWJtppEGSt+wJS0

# 0mFt6zPZxd9LBADMfRyVw4/3IbKyEbe7f/LVjHAsQWCqsWMYRJUadmJ+9oCw++hk

# pjPRiQfhvbfmQ6QYuKZ3AeEPlAwhHbJUKSWJbOUOUlFHdL4mrLZBdd56rF+NP8m8

# 00ERElvlEFDrMcXKchYiCd98THU/Y+whX8QgUWtvsauGi0/C1kVfnSD8oR7FwI+i

# sX4KJpn15GkvmB0t9dmpsh3lGwIDAQABo4IBOjCCATYwDwYDVR0TAQH/BAUwAwEB

# /zAdBgNVHQ4EFgQU7NfjgtJxXWRM3y5nP+e6mK4cD08wHwYDVR0jBBgwFoAUReui

# r/SSy4IxLVGLp6chnfNtyA8wDgYDVR0PAQH/BAQDAgGGMHkGCCsGAQUFBwEBBG0w

# azAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEMGCCsGAQUF

# BzAChjdodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVk

# SURSb290Q0EuY3J0MEUGA1UdHwQ+MDwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2lj

# ZXJ0LmNvbS9EaWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwEQYDVR0gBAowCDAG

# BgRVHSAAMA0GCSqGSIb3DQEBDAUAA4IBAQBwoL9DXFXnOF+go3QbPbYW1/e/Vwe9

# mqyhhyzshV6pGrsi+IcaaVQi7aSId229GhT0E0p6Ly23OO/0/4C5+KH38nLeJLxS

# A8hO0Cre+i1Wz/n096wwepqLsl7Uz9FDRJtDIeuWcqFItJnLnU+nBgMTdydE1Od/

# 6Fmo8L8vC6bp8jQ87PcDx4eo0kxAGTVGamlUsLihVo7spNU96LHc/RzY9HdaXFSM

# b++hUD38dglohJ9vytsgjTVgHAIDyyCwrFigDkBjxZgiwbJZ9VVrzyerbHbObyMt

# 9H5xaiNrIv8SuFQtJ37YOtnwtoeW/VvRXKwYw02fc7cBqZ9Xql4o4rmUMYIDfDCC

# A3gCAQEwfTBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4x

# QTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgVGltZVN0YW1waW5nIFJTQTQw

# OTYgU0hBMjU2IDIwMjUgQ0ExAhAKgO8YS43xBYLRxHanlXRoMA0GCWCGSAFlAwQC

# AQUAoIHRMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAcBgkqhkiG9w0BCQUx

# DxcNMjYwNTA3MjE0NjUwWjArBgsqhkiG9w0BCRACDDEcMBowGDAWBBTdYjCshgot

# MGvaOLFoeVIwB/tBfjAvBgkqhkiG9w0BCQQxIgQgiCg0uMvG8rZ0F5Pn+evBTpl1

# muWsuIQhe/IzEivPzJ8wNwYLKoZIhvcNAQkQAi8xKDAmMCQwIgQgSqA/oizXXITF

# XJOPgo5na5yuyrM/420mmqM08UYRCjMwDQYJKoZIhvcNAQEBBQAEggIABo2+UsO5

# j+uBHofxN9hLCagX6AIQEzOGLmvppYUQluFsJdtEuxfKlK8H6CzrAqfvmf/PrN9h

# EORdkwsTLkyP9CuLtyZeXR4I7h02iWqtTe+2MRmhKdGIrq2DPVRk6MogKPjdSVeo

# j85FjesUZ86CRtX5LRiSx1GAiFt7sQ9MYLo9Z2GvSCDcC0Z8pVhWRLSUsOtaAPT9

# W/8oVdneFHqzq3hSDysUSWtH6hMAMExqkDL98fucfk5mPjthVfIr9NYGxc1XOy8R

# +qGPnS/mV+mZ64ZlToBwaybayaCbfwL6ItXayU8JlnLwVTWVzWSp+08Wfrn5op2W

# cg8XD+e+1TWIEYJpDr8/+QF8/ilLx7QxmOnxCF3krQ+YxDTkgor+bkS/6vUqcpbq

# 0Pk66W6w7FLsD4I7G4ee0zzv2p/Wk17cmfKxwJ2TP2AWP1kNLvRRZa+seOc/iWwx

# zY6eAIevdmyItFQkl1jI6F4GQhbygewkV+ZA5hsHrCGYEuMlEtK6OLZv/zRpM1jv

# 3FFF6h/zs77km7zL27obsz/OkLXiwxof7Q0oFX9Am/c6rCbamA67Sb3Eigk2FbKW

# 5hdE8AKuNOpwL9CFj0lpHFdQ0MC3PpC4Iu31j/8ueI0CMxstof+LMPvSnjLiAmyL

# 8njO5lGtNU2RKYBQ1uNCF4nOdtF3b1IVdOk=

# SIG # End signature block