AzureRM.KeyVault

1.1.5

ResourceManagerStartup.ps1

                                # ----------------------------------------------------------------------------------

#

# Copyright Microsoft Corporation

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

# http://www.apache.org/licenses/LICENSE-2.0

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

# ----------------------------------------------------------------------------------

# Authorization script commandlet that builds on top of existing Insights comandlets. 

# This commandlet gets all events for the "Microsoft.Authorization" resource provider by calling the "Get-AzureRmResourceProviderLog" commandlet

function Get-AzureRmAuthorizationChangeLog { 

<#

.SYNOPSIS

Gets access change history for the selected subscription for the specified time range i.e. role assignments that were added or removed, including classic administrators (co-administrators and service administrators).

Maximum duration that can be queried is 15 days (going back up to past 90 days).

.DESCRIPTION

The Get-AzureRmAuthorizationChangeLog produces a report of who granted (or revoked) what role to whom at what scope within the subscription for the specified time range. 

The command queries all role assignment events from the Insights resource provider of Azure Resource Manager. Specifying the time range is optional. If both StartTime and EndTime parameters are not specified, the default query interval is the past 1 hour. Maximum duration that can be queried is 15 days (going back up to past 90 days).

.PARAMETER StartTime 

Start time of the query. Optional.

.PARAMETER EndTime 

End time of the query. Optional

.EXAMPLE 

Get-AzureRmAuthorizationChangeLog

Gets the access change logs for the past hour.

.EXAMPLE   

Get-AzureRmAuthorizationChangeLog -StartTime "09/20/2015 15:00" -EndTime "09/24/2015 15:00"

Gets all access change logs between the specified dates

Timestamp        : 2015-09-23 21:52:41Z

Caller           : admin@rbacCliTest.onmicrosoft.com

Action           : Revoked

PrincipalId      : 54401967-8c4e-474a-9fbb-a42073f1783c

PrincipalName    : testUser

PrincipalType    : User

Scope            : /subscriptions/9004a9fd-d58e-48dc-aeb2-4a4aec58606f/resourceGroups/TestRG/providers/Microsoft.Network/virtualNetworks/testresource

ScopeName        : testresource

ScopeType        : Resource

RoleDefinitionId : /subscriptions/9004a9fd-d58e-48dc-aeb2-4a4aec58606f/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c

RoleName         : Contributor

.EXAMPLE 

Get-AzureRmAuthorizationChangeLog  -StartTime ([DateTime]::Now - [TimeSpan]::FromDays(5)) -EndTime ([DateTime]::Now) | FT Caller, Action, RoleName, PrincipalName, ScopeType

Gets access change logs for the past 5 days and format the output

Caller                  Action                  RoleName                PrincipalName           ScopeType

------                  ------                  --------                -------------           ---------

admin@contoso.com       Revoked                 Contributor             User1                   Subscription

admin@contoso.com       Granted                 Reader                  User1                   Resource Group

admin@contoso.com       Revoked                 Contributor             Group1                  Resource

.LINK

New-AzureRmRoleAssignment

.LINK

Get-AzureRmRoleAssignment

.LINK

Remove-AzureRmRoleAssignment

#>

    [CmdletBinding()] 

    param(  

        [parameter(Mandatory=$false, ValueFromPipelineByPropertyName=$true, HelpMessage = "The start time. Optional

             If both StartTime and EndTime are not provided, defaults to querying for the past 1 hour. Maximum allowed difference in StartTime and EndTime is 15 days")] 

        [DateTime] $StartTime,

        [parameter(Mandatory=$false, ValueFromPipelineByPropertyName=$true, HelpMessage = "The end time. Optional. 

            If both StartTime and EndTime are not provided, defaults to querying for the past 1 hour. Maximum allowed difference in StartTime and EndTime is 15 days")] 

        [DateTime] $EndTime

    ) 

    PROCESS { 

         # Get all events for the "Microsoft.Authorization" provider by calling the Insights commandlet

         $events = Get-AzureRmLog -ResourceProvider "Microsoft.Authorization" -DetailedOutput -StartTime $StartTime -EndTime $EndTime

         $startEvents = @{}

         $endEvents = @{}

         $offlineEvents = @()

         # StartEvents and EndEvents will contain matching pairs of logs for when role assignments (and definitions) were created or deleted. 

         # i.e. A PUT on roleassignments will have a Start-End event combination and a DELETE on roleassignments will have another Start-End event combination

         $startEvents = $events | ? { $_.httpRequest -and $_.Status -ieq "Started" }

         $events | ? { $_.httpRequest -and $_.Status -ne "Started" } | % { $endEvents[$_.OperationId] = $_ }

         # This filters non-RBAC events like classic administrator write or delete

         $events | ? { $_.httpRequest -eq $null } | % { $offlineEvents += $_ } 

         $output = @()

         # Get all role definitions once from the service and cache to use for all 'startevents'

         $azureRoleDefinitionCache = @{}

         Get-AzureRmRoleDefinition | % { $azureRoleDefinitionCache[$_.Id] = $_ }

         $principalDetailsCache = @{}

         # Process StartEvents

         # Find matching EndEvents that succeeded and relating to role assignments only

         $startEvents | ? { $endEvents.ContainsKey($_.OperationId) `

             -and $endEvents[$_.OperationId] -ne $null `

             -and $endevents[$_.OperationId].OperationName.StartsWith("Microsoft.Authorization/roleAssignments", [System.StringComparison]::OrdinalIgnoreCase)  `

             -and $endEvents[$_.OperationId].Status -ieq "Succeeded"} |  % {

         $endEvent = $endEvents[$_.OperationId];

         # Create the output structure

         $out = "" | select Timestamp, Caller, Action, PrincipalId, PrincipalName, PrincipalType, Scope, ScopeName, ScopeType, RoleDefinitionId, RoleName

         $out.Timestamp = Get-Date -Date $endEvent.EventTimestamp -Format u

         $out.Caller = $_.Caller

         if ($_.HttpRequest.Method -ieq "PUT") {

            $out.Action = "Granted"

            if ($_.Properties.Content.ContainsKey("requestbody")) {

                $messageBody = ConvertFrom-Json $_.Properties.Content["requestbody"]

            }

          $out.Scope =  $_.Authorization.Scope

        } 

        elseif ($_.HttpRequest.Method -ieq "DELETE") {

            $out.Action = "Revoked"

            if ($endEvent.Properties.Content.ContainsKey("responseBody")) {

                $messageBody = ConvertFrom-Json $endEvent.Properties.Content["responseBody"]

            }

        }

        if ($messageBody) {

            # Process principal details

            $out.PrincipalId = $messageBody.properties.principalId

            if ($out.PrincipalId -ne $null) { 

                # Get principal details by querying Graph. Cache principal details and read from cache if present

                $principalId = $out.PrincipalId 

                if($principalDetailsCache.ContainsKey($principalId)) {

                    # Found in cache

                    $principalDetails = $principalDetailsCache[$principalId]

                } else { # not in cache

                    $principalDetails = "" | select Name, Type

                    $user = Get-AzureRmADUser -ObjectId $principalId

                    if ($user) {

                        $principalDetails.Name = $user.DisplayName

                        $principalDetails.Type = "User"    

                    } else {

                        $group = Get-AzureRmADGroup -ObjectId $principalId

                        if ($group) {

                            $principalDetails.Name = $group.DisplayName

                            $principalDetails.Type = "Group"        

                        } else {

                            $servicePrincipal = Get-AzureRmADServicePrincipal -objectId $principalId

                            if ($servicePrincipal) {

                                $principalDetails.Name = $servicePrincipal.DisplayName

                                $principalDetails.Type = "Service Principal"                        

                            }

                        }

                    }              

                    # add principal details to cache

                    $principalDetailsCache.Add($principalId, $principalDetails);

                }

                $out.PrincipalName = $principalDetails.Name

                $out.PrincipalType = $principalDetails.Type

            }

            # Process scope details

            if ([string]::IsNullOrEmpty($out.Scope)) { $out.Scope = $messageBody.properties.Scope }

            if ($out.Scope -ne $null) {

                # Remove the authorization provider details from the scope, if present

                if ($out.Scope.ToLower().Contains("/providers/microsoft.authorization")) {

                    $index = $out.Scope.ToLower().IndexOf("/providers/microsoft.authorization") 

                    $out.Scope = $out.Scope.Substring(0, $index) 

                }

                  $scope = $out.Scope 

                $resourceDetails = "" | select Name, Type

                $scopeParts = $scope.Split('/', [System.StringSplitOptions]::RemoveEmptyEntries)

                $len = $scopeParts.Length

                if ($len -gt 0 -and $len -le 2 -and $scope.ToLower().Contains("subscriptions"))    {

                    $resourceDetails.Type = "Subscription"

                    $resourceDetails.Name  = $scopeParts[1]

                } elseif ($len -gt 0 -and $len -le 4 -and $scope.ToLower().Contains("resourcegroups")) {

                    $resourceDetails.Type = "Resource Group"

                    $resourceDetails.Name  = $scopeParts[3]

                    } elseif ($len -ge 6 -and $scope.ToLower().Contains("providers")) {

                        $resourceDetails.Type = "Resource"

                        $resourceDetails.Name  = $scopeParts[$len -1]

                        }

                $out.ScopeName = $resourceDetails.Name

                $out.ScopeType = $resourceDetails.Type

            }

            # Process Role definition details

            $out.RoleDefinitionId = $messageBody.properties.roleDefinitionId

            if ($out.RoleDefinitionId -ne $null) {

                if ($azureRoleDefinitionCache[$out.RoleDefinitionId]) {

                    $out.RoleName = $azureRoleDefinitionCache[$out.RoleDefinitionId].Name

                } else {

                    $out.RoleName = ""

                }

            }

        }

        $output += $out

    } # start event processing complete

    # Filter classic admins events

    $offlineEvents | % {

        if($_.Status -ne $null -and $_.Status -ieq "Succeeded" -and $_.OperationName -ne $null -and $_.operationName.StartsWith("Microsoft.Authorization/ClassicAdministrators", [System.StringComparison]::OrdinalIgnoreCase)) {

            $out = "" | select Timestamp, Caller, Action, PrincipalId, PrincipalName, PrincipalType, Scope, ScopeName, ScopeType, RoleDefinitionId, RoleName

            $out.Timestamp = Get-Date -Date $_.EventTimestamp -Format u

            $out.Caller = "Subscription Admin"

            if($_.operationName -ieq "Microsoft.Authorization/ClassicAdministrators/write"){

                $out.Action = "Granted"

            } 

            elseif($_.operationName -ieq "Microsoft.Authorization/ClassicAdministrators/delete"){

                $out.Action = "Revoked"

            }

            $out.RoleDefinitionId = $null

            $out.PrincipalId = $null

            $out.PrincipalType = "User"

            $out.Scope = "/subscriptions/" + $_.SubscriptionId

            $out.ScopeType = "Subscription"

            $out.ScopeName = $_.SubscriptionId

            if($_.Properties -ne $null){

                $out.PrincipalName = $_.Properties.Content["adminEmail"]

                $out.RoleName = "Classic " + $_.Properties.Content["adminType"]

            }

            $output += $out

        }

    } # end offline events

    $output | Sort Timestamp

} 

} # End commandlet

# SIG # Begin signature block

# MIIdpgYJKoZIhvcNAQcCoIIdlzCCHZMCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQB

# gjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR

# AgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUhDrBInF+1t1vfhRo4+YNh7CT

# PwKgghhkMIIEwzCCA6ugAwIBAgITMwAAAJA+g1ad87qu6AAAAAAAkDANBgkqhkiG

# 9w0BAQUFADB3MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4G

# A1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSEw

# HwYDVQQDExhNaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EwHhcNMTUxMDA3MTgxNDA2

# WhcNMTcwMTA3MTgxNDA2WjCBszELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hp

# bmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jw

# b3JhdGlvbjENMAsGA1UECxMETU9QUjEnMCUGA1UECxMebkNpcGhlciBEU0UgRVNO

# OkI4RUMtMzBBNC03MTQ0MSUwIwYDVQQDExxNaWNyb3NvZnQgVGltZS1TdGFtcCBT

# ZXJ2aWNlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAr/gdTKW8IchL

# 6Go37UxPta3nbiRrxXf0TL40f7KNJZrveKT1MxSEQqVa+Z5tbdhDUWe848eK/teu

# U1o0seOfbrzaUya3mi5P6rBIP6Lg9PNgT88GEhLkC8nrPFhZ4p4THMA/WxNaYWt9

# yAJmW0SA3R2X7hjz7Ddy65FzlOQwsJAu42xgMXpLLxSnq+lg33ixGWi1pHiJEj5y

# 6Rh0nwBLzDtDQNN0VGHk5GXfmmqdRkFCtFkBiM7LXgpQdJfOwV/EC9MCzMg6j8DN

# 7aBPlPV1rMTyKSDuPHhknOQswjHD3hCa27d+jFn6dT/z+M+EzuMNl1Gt93ZgKRmu

# NO1IjynZ+wIDAQABo4IBCTCCAQUwHQYDVR0OBBYEFHjg6UouB+2CJYARF+/8msI0

# 6AsVMB8GA1UdIwQYMBaAFCM0+NlSRnAK7UD7dvuzK7DDNbMPMFQGA1UdHwRNMEsw

# SaBHoEWGQ2h0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvY3JsL3Byb2R1Y3Rz

# L01pY3Jvc29mdFRpbWVTdGFtcFBDQS5jcmwwWAYIKwYBBQUHAQEETDBKMEgGCCsG

# AQUFBzAChjxodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY3Jv

# c29mdFRpbWVTdGFtcFBDQS5jcnQwEwYDVR0lBAwwCgYIKwYBBQUHAwgwDQYJKoZI

# hvcNAQEFBQADggEBACpZvbBRXzeXypChbVh4hH2gD0Dq1YGzyzSLn2jFV53VZwR9

# 2dt+yu9y1ozW3m2ixlwH3xAzQYgHAAvc034+AQSbSsh3tR3GbMxYvjDuob2u097B

# R/6ttpn+hrhHBSC5bT0Yg5FufRbZKyrh4FawI7PGfLhDBwhgZfyWuZP6lOHSzjiF

# mSaQTJAiArB1zjQI5cRlj+N/9qUpIn5E/0gEQtk4TCRqtFYqol2e20MGsyHciwBR

# lW9iqmza80Aw5x5ZaLlwYv0fVQDpry4aEsZGmfAg2HnFYkQoVEONnqXwor+nrW3W

# yTPJ2j3cF7U44KaYVOLWYX2mCpRZUOOTlOe+F6YwggYHMIID76ADAgECAgphFmg0

# AAAAAAAcMA0GCSqGSIb3DQEBBQUAMF8xEzARBgoJkiaJk/IsZAEZFgNjb20xGTAX

# BgoJkiaJk/IsZAEZFgltaWNyb3NvZnQxLTArBgNVBAMTJE1pY3Jvc29mdCBSb290

# IENlcnRpZmljYXRlIEF1dGhvcml0eTAeFw0wNzA0MDMxMjUzMDlaFw0yMTA0MDMx

# MzAzMDlaMHcxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYD

# VQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xITAf

# BgNVBAMTGE1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQTCCASIwDQYJKoZIhvcNAQEB

# BQADggEPADCCAQoCggEBAJ+hbLHf20iSKnxrLhnhveLjxZlRI1Ctzt0YTiQP7tGn

# 0UytdDAgEesH1VSVFUmUG0KSrphcMCbaAGvoe73siQcP9w4EmPCJzB/LMySHnfL0

# Zxws/HvniB3q506jocEjU8qN+kXPCdBer9CwQgSi+aZsk2fXKNxGU7CG0OUoRi4n

# rIZPVVIM5AMs+2qQkDBuh/NZMJ36ftaXs+ghl3740hPzCLdTbVK0RZCfSABKR2YR

# JylmqJfk0waBSqL5hKcRRxQJgp+E7VV4/gGaHVAIhQAQMEbtt94jRrvELVSfrx54

# QTF3zJvfO4OToWECtR0Nsfz3m7IBziJLVP/5BcPCIAsCAwEAAaOCAaswggGnMA8G

# A1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFCM0+NlSRnAK7UD7dvuzK7DDNbMPMAsG

# A1UdDwQEAwIBhjAQBgkrBgEEAYI3FQEEAwIBADCBmAYDVR0jBIGQMIGNgBQOrIJg

# QFYnl+UlE/wq4QpTlVnkpKFjpGEwXzETMBEGCgmSJomT8ixkARkWA2NvbTEZMBcG

# CgmSJomT8ixkARkWCW1pY3Jvc29mdDEtMCsGA1UEAxMkTWljcm9zb2Z0IFJvb3Qg

# Q2VydGlmaWNhdGUgQXV0aG9yaXR5ghB5rRahSqClrUxzWPQHEy5lMFAGA1UdHwRJ

# MEcwRaBDoEGGP2h0dHA6Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvY3JsL3Byb2R1

# Y3RzL21pY3Jvc29mdHJvb3RjZXJ0LmNybDBUBggrBgEFBQcBAQRIMEYwRAYIKwYB

# BQUHMAKGOGh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljcm9z

# b2Z0Um9vdENlcnQuY3J0MBMGA1UdJQQMMAoGCCsGAQUFBwMIMA0GCSqGSIb3DQEB

# BQUAA4ICAQAQl4rDXANENt3ptK132855UU0BsS50cVttDBOrzr57j7gu1BKijG1i

# uFcCy04gE1CZ3XpA4le7r1iaHOEdAYasu3jyi9DsOwHu4r6PCgXIjUji8FMV3U+r

# kuTnjWrVgMHmlPIGL4UD6ZEqJCJw+/b85HiZLg33B+JwvBhOnY5rCnKVuKE5nGct

# xVEO6mJcPxaYiyA/4gcaMvnMMUp2MT0rcgvI6nA9/4UKE9/CCmGO8Ne4F+tOi3/F

# NSteo7/rvH0LQnvUU3Ih7jDKu3hlXFsBFwoUDtLaFJj1PLlmWLMtL+f5hYbMUVbo

# nXCUbKw5TNT2eb+qGHpiKe+imyk0BncaYsk9Hm0fgvALxyy7z0Oz5fnsfbXjpKh0

# NbhOxXEjEiZ2CzxSjHFaRkMUvLOzsE1nyJ9C/4B5IYCeFTBm6EISXhrIniIh0EPp

# K+m79EjMLNTYMoBMJipIJF9a6lbvpt6Znco6b72BJ3QGEe52Ib+bgsEnVLaxaj2J

# oXZhtG6hE6a/qkfwEm/9ijJssv7fUciMI8lmvZ0dhxJkAj0tr1mPuOQh5bWwymO0

# eFQF1EEuUKyUsKV4q7OglnUa2ZKHE3UiLzKoCG6gW4wlv6DvhMoh1useT8ma7kng

# 9wFlb4kLfchpyOZu6qeXzjEp/w7FW1zYTRuh2Povnj8uVRZryROj/TCCBhAwggP4

# oAMCAQICEzMAAABkR4SUhttBGTgAAAAAAGQwDQYJKoZIhvcNAQELBQAwfjELMAkG

# A1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQx

# HjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEoMCYGA1UEAxMfTWljcm9z

# b2Z0IENvZGUgU2lnbmluZyBQQ0EgMjAxMTAeFw0xNTEwMjgyMDMxNDZaFw0xNzAx

# MjgyMDMxNDZaMIGDMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQ

# MA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9u

# MQ0wCwYDVQQLEwRNT1BSMR4wHAYDVQQDExVNaWNyb3NvZnQgQ29ycG9yYXRpb24w

# ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCTLtrY5j6Y2RsPZF9NqFhN

# FDv3eoT8PBExOu+JwkotQaVIXd0Snu+rZig01X0qVXtMTYrywPGy01IVi7azCLiL

# UAvdf/tqCaDcZwTE8d+8dRggQL54LJlW3e71Lt0+QvlaHzCuARSKsIK1UaDibWX+

# 9xgKjTBtTTqnxfM2Le5fLKCSALEcTOLL9/8kJX/Xj8Ddl27Oshe2xxxEpyTKfoHm

# 5jG5FtldPtFo7r7NSNCGLK7cDiHBwIrD7huTWRP2xjuAchiIU/urvzA+oHe9Uoi/

# etjosJOtoRuM1H6mEFAQvuHIHGT6hy77xEdmFsCEezavX7qFRGwCDy3gsA4boj4l

# AgMBAAGjggF/MIIBezAfBgNVHSUEGDAWBggrBgEFBQcDAwYKKwYBBAGCN0wIATAd

# BgNVHQ4EFgQUWFZxBPC9uzP1g2jM54BG91ev0iIwUQYDVR0RBEowSKRGMEQxDTAL

# BgNVBAsTBE1PUFIxMzAxBgNVBAUTKjMxNjQyKzQ5ZThjM2YzLTIzNTktNDdmNi1h

# M2JlLTZjOGM0NzUxYzRiNjAfBgNVHSMEGDAWgBRIbmTlUAXTgqoXNzcitW2oynUC

# lTBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtp

# b3BzL2NybC9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3JsMGEGCCsGAQUF

# BwEBBFUwUzBRBggrBgEFBQcwAoZFaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3Br

# aW9wcy9jZXJ0cy9NaWNDb2RTaWdQQ0EyMDExXzIwMTEtMDctMDguY3J0MAwGA1Ud

# EwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIBAIjiDGRDHd1crow7hSS1nUDWvWas

# W1c12fToOsBFmRBN27SQ5Mt2UYEJ8LOTTfT1EuS9SCcUqm8t12uD1ManefzTJRtG

# ynYCiDKuUFT6A/mCAcWLs2MYSmPlsf4UOwzD0/KAuDwl6WCy8FW53DVKBS3rbmdj

# vDW+vCT5wN3nxO8DIlAUBbXMn7TJKAH2W7a/CDQ0p607Ivt3F7cqhEtrO1Rypehh

# bkKQj4y/ebwc56qWHJ8VNjE8HlhfJAk8pAliHzML1v3QlctPutozuZD3jKAO4WaV

# qJn5BJRHddW6l0SeCuZmBQHmNfXcz4+XZW/s88VTfGWjdSGPXC26k0LzV6mjEaEn

# S1G4t0RqMP90JnTEieJ6xFcIpILgcIvcEydLBVe0iiP9AXKYVjAPn6wBm69FKCQr

# IPWsMDsw9wQjaL8GHk4wCj0CmnixHQanTj2hKRc2G9GL9q7tAbo0kFNIFs0EYkbx

# Cn7lBOEqhBSTyaPS6CvjJZGwD0lNuapXDu72y4Hk4pgExQ3iEv/Ij5oVWwT8okie

# +fFLNcnVgeRrjkANgwoAyX58t0iqbefHqsg3RGSgMBu9MABcZ6FQKwih3Tj0DVPc

# gnJQle3c6xN3dZpuEgFcgJh/EyDXSdppZzJR4+Bbf5XA/Rcsq7g7X7xl4bJoNKLf

# cafOabJhpxfcFOowMIIHejCCBWKgAwIBAgIKYQ6Q0gAAAAAAAzANBgkqhkiG9w0B

# AQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNV

# BAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEyMDAG

# A1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IDIwMTEw

# HhcNMTEwNzA4MjA1OTA5WhcNMjYwNzA4MjEwOTA5WjB+MQswCQYDVQQGEwJVUzET

# MBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMV

# TWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYDVQQDEx9NaWNyb3NvZnQgQ29kZSBT

# aWduaW5nIFBDQSAyMDExMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA

# q/D6chAcLq3YbqqCEE00uvK2WCGfQhsqa+laUKq4BjgaBEm6f8MMHt03a8YS2Avw

# OMKZBrDIOdUBFDFC04kNeWSHfpRgJGyvnkmc6Whe0t+bU7IKLMOv2akrrnoJr9eW

# WcpgGgXpZnboMlImEi/nqwhQz7NEt13YxC4Ddato88tt8zpcoRb0RrrgOGSsbmQ1

# eKagYw8t00CT+OPeBw3VXHmlSSnnDb6gE3e+lD3v++MrWhAfTVYoonpy4BI6t0le

# 2O3tQ5GD2Xuye4Yb2T6xjF3oiU+EGvKhL1nkkDstrjNYxbc+/jLTswM9sbKvkjh+

# 0p2ALPVOVpEhNSXDOW5kf1O6nA+tGSOEy/S6A4aN91/w0FK/jJSHvMAhdCVfGCi2

# zCcoOCWYOUo2z3yxkq4cI6epZuxhH2rhKEmdX4jiJV3TIUs+UsS1Vz8kA/DRelsv

# 1SPjcF0PUUZ3s/gA4bysAoJf28AVs70b1FVL5zmhD+kjSbwYuER8ReTBw3J64HLn

# JN+/RpnF78IcV9uDjexNSTCnq47f7Fufr/zdsGbiwZeBe+3W7UvnSSmnEyimp31n

# gOaKYnhfsi+E11ecXL93KCjx7W3DKI8sj0A3T8HhhUSJxAlMxdSlQy90lfdu+Hgg

# WCwTXWCVmj5PM4TasIgX3p5O9JawvEagbJjS4NaIjAsCAwEAAaOCAe0wggHpMBAG

# CSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRIbmTlUAXTgqoXNzcitW2oynUClTAZ

# BgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/

# BAUwAwEB/zAfBgNVHSMEGDAWgBRyLToCMZBDuRQFTuHqp8cx0SOJNDBaBgNVHR8E

# UzBRME+gTaBLhklodHRwOi8vY3JsLm1pY3Jvc29mdC5jb20vcGtpL2NybC9wcm9k

# dWN0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3JsMF4GCCsGAQUFBwEB

# BFIwUDBOBggrBgEFBQcwAoZCaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9j

# ZXJ0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFfMDNfMjIuY3J0MIGfBgNVHSAEgZcw

# gZQwgZEGCSsGAQQBgjcuAzCBgzA/BggrBgEFBQcCARYzaHR0cDovL3d3dy5taWNy

# b3NvZnQuY29tL3BraW9wcy9kb2NzL3ByaW1hcnljcHMuaHRtMEAGCCsGAQUFBwIC

# MDQeMiAdAEwAZQBnAGEAbABfAHAAbwBsAGkAYwB5AF8AcwB0AGEAdABlAG0AZQBu

# AHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQBn8oalmOBUeRou09h0ZyKbC5YR4WOS

# mUKWfdJ5DJDBZV8uLD74w3LRbYP+vj/oCso7v0epo/Np22O/IjWll11lhJB9i0ZQ

# VdgMknzSGksc8zxCi1LQsP1r4z4HLimb5j0bpdS1HXeUOeLpZMlEPXh6I/MTfaaQ

# dION9MsmAkYqwooQu6SpBQyb7Wj6aC6VoCo/KmtYSWMfCWluWpiW5IP0wI/zRive

# /DvQvTXvbiWu5a8n7dDd8w6vmSiXmE0OPQvyCInWH8MyGOLwxS3OW560STkKxgrC

# xq2u5bLZ2xWIUUVYODJxJxp/sfQn+N4sOiBpmLJZiWhub6e3dMNABQamASooPoI/

# E01mC8CzTfXhj38cbxV9Rad25UAqZaPDXVJihsMdYzaXht/a8/jyFqGaJ+HNpZfQ

# 7l1jQeNbB5yHPgZ3BtEGsXUfFL5hYbXw3MYbBL7fQccOKO7eZS/sl/ahXJbYANah

# Rr1Z85elCUtIEJmAH9AAKcWxm6U/RXceNcbSoqKfenoi+kiVH6v7RyOA9Z74v2u3

# S5fi63V4GuzqN5l5GEv/1rMjaHXmr/r8i+sLgOppO6/8MO0ETI7f33VtY5E90Z1W

# Tk+/gFcioXgRMiF670EKsT/7qMykXcGhiJtXcVZOSEXAQsmbdlsKgEhr/Xmfwb1t

# bWrJUnMTDXpQzTGCBKwwggSoAgEBMIGVMH4xCzAJBgNVBAYTAlVTMRMwEQYDVQQI

# EwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3Nv

# ZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25pbmcg

# UENBIDIwMTECEzMAAABkR4SUhttBGTgAAAAAAGQwCQYFKw4DAhoFAKCBwDAZBgkq

# hkiG9w0BCQMxDAYKKwYBBAGCNwIBBDAcBgorBgEEAYI3AgELMQ4wDAYKKwYBBAGC

# NwIBFTAjBgkqhkiG9w0BCQQxFgQUUzv+oDeVAJPyZ3Xgmf2nLWXtVS4wYAYKKwYB

# BAGCNwIBDDFSMFCgNoA0AE0AaQBjAHIAbwBzAG8AZgB0ACAAQQB6AHUAcgBlACAA

# UABvAHcAZQByAFMAaABlAGwAbKEWgBRodHRwOi8vQ29kZVNpZ25JbmZvIDANBgkq

# hkiG9w0BAQEFAASCAQCCUp/ZgXAE4+46i0iTyjmwJ92NFmogsYUXtmo7XjS1Q9To

# XtR7N1m4T6BW2mYfOzdATgLK4CEFgnco+d3x7uWvUp8dpXe61FZVXjeWUBVVvFqy

# r71vEQz3gK+lhKHDU+7D81cYvvNjkWBDz2hxEyjSY02ZHxCyE5sp8Cstjwngzo5A

# zqJ5BxGvQzafNHu2Tjg5JIe19wcXKOnMkVH1zG2pVX6bFGhoQRgdnDyDs3Qj+GAM

# 9B/eGYumPkuBWv5iDrBkB2q3u9J02cfW2s9fWwtJ+j9WYPzoFElYqiRww45KxVQS

# OzWd+bAfn9DWtZW7ss5NKdZDrmI8p8xuCr12yvDJoYICKDCCAiQGCSqGSIb3DQEJ

# BjGCAhUwggIRAgEBMIGOMHcxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5n

# dG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9y

# YXRpb24xITAfBgNVBAMTGE1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQQITMwAAAJA+

# g1ad87qu6AAAAAAAkDAJBgUrDgMCGgUAoF0wGAYJKoZIhvcNAQkDMQsGCSqGSIb3

# DQEHATAcBgkqhkiG9w0BCQUxDxcNMTYwMzMwMDY0MzA3WjAjBgkqhkiG9w0BCQQx

# FgQUkLnvRW/lgBORWPTWosE5w136xpMwDQYJKoZIhvcNAQEFBQAEggEAZjQD+8Z3

# CKE7HoEtBs1alCi8RhVEFRpiEilIzLKVTVRUp5B1MwRip6Z/JidaUrX3WBsE5imo

# YJEo1RpeWr4GKljdPSsw/bhrq7Wk7Vjd8PGHT1ebkkmAqrgUfOk8yZaCua8oJALL

# YKHGBLcOJzWleFTFcIBS8yrW+F+hn8kZhG73J9+bo3Jf/d5Xg/5zbdCxjDO3Q+99

# v/IScJRWUq2PG2Z445GoB3Gmyz9VBJ/+Ie13eFmgg3mWlgsJXWLfVsQEeApfzULy

# 9MZN8sJyKx8PzeOvkHtrK9B2CzrCa91oyt7OXJ26zA5nLhsMZwVNzovBgjjsImLT

# iD4FAq9jndWc7Q==

# SIG # End signature block