EntraOps

1.0.0

Public/PrivilegedAccess/Export-EntraOpsClassificationAzureRoles.ps1

                                function Export-EntraOpsClassificationAzureRoles {

    <#

    .SYNOPSIS

        Get a JSON file with all classified Azure RBAC roles.

    .DESCRIPTION

        Read JSON classification file and match Azure RBAC role definitions (Control/Management plane Actions and Data plane DataActions) to export it as JSON.

    .PARAMETER SingleClassification

        Use the highest tier level classification only for each role definition. Default is $True.

    .PARAMETER IncludeCustomRoles

        Include custom role definitions in addition to built-in roles. Default is $False.

    .PARAMETER DefaultScope

        Default role assignment scope used for classification lookup. Default is "/*" (applies to any scope).

    .PARAMETER ClassificationFile

        Path to the JSON classification definition file. Default is "./EntraOps_Classification/Classification_Azure.json".

        When the parameterized file (Classification_Azure.Param.json) is used, the scope placeholders are substituted with the values from Tier0IncludedResourceScope and Tier1IncludedResourceScope.

        Each TierLevelDefinition entry may set an optional "ActionType" property ("Action" or "DataAction", defaults to "Action" when omitted). Its "RoleDefinitionActions"/

        "ExcludedRoleDefinitionActions" patterns are matched only against a role's permissions from that same plane. Azure RBAC Actions and DataActions are separate

        namespaces (e.g. "Microsoft.KeyVault/vaults/write" is an Action, "Microsoft.KeyVault/vaults/secrets/read" is a DataAction), so a pattern authored for one plane is

        never matched against a role's permissions from the other plane - services with both control/management plane and data plane permissions (e.g. Key Vault) use two

        sibling TierLevelDefinition entries, one per ActionType. Wildcards ("*") are supported in either direction within a plane (e.g. a classified pattern

        "Microsoft.KeyVault/*/read" matches a role's literal "Microsoft.KeyVault/vaults/read" action, and a role's wildcard action "Microsoft.KeyVault/vaults/secrets/*"

        matches a classified literal "Microsoft.KeyVault/vaults/secrets/read").

    .PARAMETER Tier0IncludedResourceScope

        List of Azure scopes (management groups, subscriptions, resource groups) which are treated as Control Plane (Tier 0). Used to substitute the <Tier0IncludedResourceScope> placeholder in the parameterized classification file. The tenant root scope ("/") is always included as Control Plane in addition to the scopes provided here.

    .PARAMETER Tier1IncludedResourceScope

        List of Azure scopes (management groups, subscriptions, resource groups) which are treated as Management Plane (Tier 1). Used to substitute the <Tier1IncludedResourceScope> placeholder in the parameterized classification file.

    .PARAMETER RoleDefinitionScope

        Optional scope passed to Get-AzRoleDefinition. Set this to the tenant root ("/") to also include tenant-scoped built-in roles (e.g. Reservations Administrator) which are not returned by the default subscription-scoped query. Default is $null (current Az context default).

    .PARAMETER Exportfile

        Path to the JSON file which should be exported. Default is ".\Classification\Classification_AzureResources.json".

    .EXAMPLE

        Export all classified Azure RBAC roles to the default export path.

        Export-EntraOpsClassificationAzureRoles

    .EXAMPLE

        Export all classified Azure RBAC roles including custom roles.

        Export-EntraOpsClassificationAzureRoles -IncludeCustomRoles $true

    #>

    [cmdletbinding()]

    param

    (

        [Parameter(Mandatory = $false)]

        $SingleClassification = $True

        ,

        [Parameter(Mandatory = $false)]

        $IncludeCustomRoles = $False

        ,

        [Parameter(Mandatory = $false)]

        $DefaultScope = "/*"

        ,

        [Parameter(Mandatory = $false)]

        $ClassificationFile = "./EntraOps_Classification/Classification_Azure.json"

        ,

        [Parameter(Mandatory = $false)]

        [string[]] $Tier0IncludedResourceScope = @()

        ,

        [Parameter(Mandatory = $false)]

        [string[]] $Tier1IncludedResourceScope = @()

        ,

        [Parameter(Mandatory = $false)]

        $RoleDefinitionScope = $null

        ,

        [Parameter(Mandatory = $false)]

        $Exportfile = ".\Classification\Classification_AzureResources.json"

    )

    # Wildcard-aware matching between an Azure role action and a classified action (both directions, case-insensitive)

    function Test-EntraOpsAzureActionMatch {

        param

        (

            [Parameter(Mandatory = $true)] [AllowEmptyString()] [string] $RoleAction,

            [Parameter(Mandatory = $true)] [AllowEmptyString()] [string] $ClassifiedAction

        )

        if ([string]::IsNullOrEmpty($RoleAction) -or [string]::IsNullOrEmpty($ClassifiedAction)) {

            return $false

        }

        # Azure documents */read as control-plane metadata access; it cannot by itself

        # grant a concrete telemetry or other sensitive-read operation.

        if ($RoleAction -eq '*/read' -and $ClassifiedAction -ne '*/read') {

            return $false

        }

        if ($RoleAction -eq $ClassifiedAction) {

            return $true

        }

        $RolePattern = '^' + [Regex]::Escape($RoleAction).Replace('\*', '.*') + '$'

        $ClassifiedPattern = '^' + [Regex]::Escape($ClassifiedAction).Replace('\*', '.*') + '$'

        # Classified definition contains a wildcard which covers the role action (e.g. "Microsoft.Authorization/*/write")

        if ($ClassifiedAction.Contains('*') -and $RoleAction -imatch $ClassifiedPattern) {

            return $true

        }

        # Role action contains a wildcard which covers the classified action (e.g. role grants "Microsoft.Compute/*")

        if ($RoleAction.Contains('*') -and $ClassifiedAction -imatch $RolePattern) {

            return $true

        }

        return $false

    }

    # Determine whether a classified action is removed by a role's NotActions/NotDataActions. Only a NotAction

    # which is equal to or broader than the classified action cancels it (one-directional coverage), so a narrow

    # NotAction (e.g. "Microsoft.Authorization/roleAssignments/write") does not cancel a broad classified wildcard

    # (e.g. "Microsoft.Authorization/*/write").

    function Test-EntraOpsAzureActionExcluded {

        param

        (

            [Parameter(Mandatory = $true)] [AllowEmptyString()] [string] $ClassifiedAction,

            [Parameter(Mandatory = $false)] [string[]] $ExcludedActions = @()

        )

        if ([string]::IsNullOrEmpty($ClassifiedAction)) {

            return $false

        }

        foreach ($ExcludedAction in $ExcludedActions) {

            if ([string]::IsNullOrEmpty($ExcludedAction)) {

                continue

            }

            if ($ExcludedAction -eq $ClassifiedAction) {

                return $true

            }

            $ExcludedPattern = '^' + [Regex]::Escape($ExcludedAction).Replace('\*', '.*') + '$'

            if ($ClassifiedAction -imatch $ExcludedPattern) {

                return $true

            }

        }

        return $false

    }

    # A TierLevelDefinition entry's plane defaults to "Action" when the optional ActionType property is absent,

    # so classification files/entries without any data plane concept (Entra ID, Identity Governance, Device

    # Management, and most Azure services) never need to set it.

    function Get-EntraOpsTierDefinitionActionType {

        param

        (

            [Parameter(Mandatory = $true)] $TierDefinition

        )

        if ($null -ne $TierDefinition.ActionType -and $TierDefinition.ActionType -eq "DataAction") {

            return "DataAction"

        }

        return "Action"

    }

    # Resolve the tier level and service classification for a single Azure role action. Azure RBAC keeps

    # control/management plane Actions and data plane DataActions in entirely separate namespaces (e.g.

    # "Microsoft.KeyVault/vaults/write" is an Action, "Microsoft.KeyVault/vaults/secrets/read" is a DataAction),

    # so a TierLevelDefinition entry is only considered when its own plane (ActionType) matches the plane of the

    # role permission being classified - a pattern authored for one plane is never matched against a role

    # permission from the other plane.

    function Get-EntraOpsAzureActionClassification {

        param

        (

            [Parameter(Mandatory = $true)] [string] $RoleAction,

            [Parameter(Mandatory = $true)] [ValidateSet("Action", "DataAction")] [string] $ActionType,

            [Parameter(Mandatory = $true)] $Classification,

            [Parameter(Mandatory = $true)] [string] $Scope,

            [Parameter(Mandatory = $false)] [string[]] $ExcludedActions = @()

        )

        foreach ($TierLevel in $Classification) {

            foreach ($TierDefinition in $TierLevel.TierLevelDefinition) {

                if ((Get-EntraOpsTierDefinitionActionType -TierDefinition $TierDefinition) -ne $ActionType) {

                    continue

                }

                $ScopeMatch = ($TierDefinition.RoleAssignmentScopeName -contains $Scope) -or ($TierDefinition.RoleAssignmentScopeName -contains "/*")

                if (-not $ScopeMatch) {

                    continue

                }

                # Honor excluded role assignment scopes (e.g. Management Plane definitions which defer to Control Plane on Tier 0 scopes)

                if ($null -ne $TierDefinition.ExcludedRoleAssignmentScopeName -and ($TierDefinition.ExcludedRoleAssignmentScopeName -contains $Scope)) {

                    continue

                }

                $ExcludedMatch = $false

                foreach ($ExcludedAction in $TierDefinition.ExcludedRoleDefinitionActions) {

                    if (Test-EntraOpsAzureActionMatch -RoleAction $RoleAction -ClassifiedAction $ExcludedAction) {

                        $ExcludedMatch = $true

                        break

                    }

                }

                if ($ExcludedMatch) {

                    continue

                }

                foreach ($ClassifiedAction in $TierDefinition.RoleDefinitionActions) {

                    if (Test-EntraOpsAzureActionMatch -RoleAction $RoleAction -ClassifiedAction $ClassifiedAction) {

                        # Skip when the role explicitly removes this capability via NotActions/NotDataActions

                        if (Test-EntraOpsAzureActionExcluded -ClassifiedAction $ClassifiedAction -ExcludedActions $ExcludedActions) {

                            continue

                        }

                        return [PSCustomObject]@{

                            "Service"              = $TierDefinition.Service

                            "EAMTierLevelName"     = $TierLevel.EAMTierLevelName

                            "EAMTierLevelTagValue" = $TierLevel.EAMTierLevelTagValue

                        }

                    }

                }

            }

        }

        return $null

    }

    # Read permission arrays from a role definition, supporting both the legacy flattened properties

    # (Actions/NotActions/DataActions/NotDataActions) and the new Permissions[] structure which replaces

    # them (breaking change announced for Get-AzRoleDefinition / PSRoleDefinition).

    function Get-EntraOpsRolePermission {

        param

        (

            [Parameter(Mandatory = $true)] $RoleDefinition,

            [Parameter(Mandatory = $true)] [ValidateSet("Actions", "NotActions", "DataActions", "NotDataActions")] [string] $PermissionType

        )

        if ($null -ne $RoleDefinition.Permissions -and @($RoleDefinition.Permissions).Count -gt 0) {

            return @($RoleDefinition.Permissions | ForEach-Object { $_.$PermissionType } | Where-Object { $null -ne $_ })

        }

        return @($RoleDefinition.$PermissionType)

    }

    # Get EntraOps Classification (substitute scope placeholders when a parameterized classification file is used)

    # The tenant root scope ("/") is always treated as Control Plane (Tier 0), regardless of the caller-provided

    # Tier0IncludedResourceScope, since it is used both to include it on Control Plane definitions and to exclude

    # it from Management Plane definitions (via <Tier0IncludedResourceScope> in ExcludedRoleAssignmentScopeName).

    $ClassificationContent = Get-Content -Path $ClassificationFile -Raw

    $EffectiveTier0IncludedResourceScope = @("/") + @($Tier0IncludedResourceScope | Where-Object { $_ -ne "/" })

    $Tier0ScopeReplacement = (($EffectiveTier0IncludedResourceScope | ForEach-Object { '"' + $_ + '"' }) -join ", ")

    $Tier1ScopeReplacement = (($Tier1IncludedResourceScope | ForEach-Object { '"' + $_ + '"' }) -join ", ")

    $ClassificationContent = $ClassificationContent.Replace("<Tier0IncludedResourceScope>", $Tier0ScopeReplacement)

    $ClassificationContent = $ClassificationContent.Replace("<Tier1IncludedResourceScope>", $Tier1ScopeReplacement)

    $Classification = $ClassificationContent | ConvertFrom-Json -Depth 10

    # Query Azure RBAC role definitions for mapping ID to name and further details

    Write-Output "Query Azure RBAC role definitions for mapping ID to name and further details"

    if ($null -ne $RoleDefinitionScope -and -not [string]::IsNullOrEmpty($RoleDefinitionScope)) {

        # Query at a specific scope (e.g. the tenant root "/") to also include tenant-scoped built-in roles such as Reservations Administrator

        $AzureRoleDefinitions = Get-AzRoleDefinition -Scope $RoleDefinitionScope

    } else {

        $AzureRoleDefinitions = Get-AzRoleDefinition

    }

    $AzureRoleDefinitions = $AzureRoleDefinitions | Select-Object Id, Name, IsCustom, Description, Actions, NotActions, DataActions, NotDataActions, Permissions

    if ($IncludeCustomRoles -eq $False) {

        $AzureRoleDefinitions = $AzureRoleDefinitions | Where-Object { $_.IsCustom -eq $False }

    }

    $AzureRoles = $AzureRoleDefinitions | ForEach-Object {

        # Combine control/management plane Actions and data plane DataActions for classification

        $RoleActions = Get-EntraOpsRolePermission -RoleDefinition $_ -PermissionType "Actions"

        $RoleNotActions = Get-EntraOpsRolePermission -RoleDefinition $_ -PermissionType "NotActions"

        $RoleDataActions = Get-EntraOpsRolePermission -RoleDefinition $_ -PermissionType "DataActions"

        $RoleNotDataActions = Get-EntraOpsRolePermission -RoleDefinition $_ -PermissionType "NotDataActions"

        $RolePermissionEntries = New-Object System.Collections.ArrayList

        foreach ($Action in $RoleActions) {

            $RolePermissionEntries.Add([PSCustomObject]@{ "Action" = $Action; "ActionType" = "Action"; "ExcludedActions" = $RoleNotActions }) | Out-Null

        }

        foreach ($DataAction in $RoleDataActions) {

            $RolePermissionEntries.Add([PSCustomObject]@{ "Action" = $DataAction; "ActionType" = "DataAction"; "ExcludedActions" = $RoleNotDataActions }) | Out-Null

        }

        $ClassifiedAzureRolePermissions = New-Object System.Collections.ArrayList

        foreach ($RolePermissionEntry in $RolePermissionEntries) {

            $RolePermission = $RolePermissionEntry.Action

            # Apply Classification (matched only against classification patterns authored for the same plane/ActionType)

            $AzureRolePermissionClassification = Get-EntraOpsAzureActionClassification -RoleAction $RolePermission -ActionType $RolePermissionEntry.ActionType -Classification $Classification -Scope $DefaultScope -ExcludedActions $RolePermissionEntry.ExcludedActions

            if ($null -eq $AzureRolePermissionClassification) {

                $AzureRolePermissionClassification = [PSCustomObject]@{

                    "Service"              = "Unclassified"

                    "EAMTierLevelName"     = "Unclassified"

                    "EAMTierLevelTagValue" = "Unclassified"

                }

            }

            $ClassifiedAzureRolePermission = (

                [PSCustomObject]@{

                    "AuthorizedResourceAction" = $RolePermission

                    "ActionType"               = $RolePermissionEntry.ActionType

                    "Category"                 = $AzureRolePermissionClassification.Service

                    "EAMTierLevelName"         = $AzureRolePermissionClassification.EAMTierLevelName

                    "EAMTierLevelTagValue"     = $AzureRolePermissionClassification.EAMTierLevelTagValue

                }

            )

            $ClassifiedAzureRolePermissions.Add($ClassifiedAzureRolePermission) | Out-Null

        }

        $ClassifiedAzureRolePermissions = $ClassifiedAzureRolePermissions | Sort-Object EAMTierLevelTagValue, Category, AuthorizedResourceAction, ActionType

        if ($SingleClassification -eq $True) {

            $RoleDefinitionClassification = ($ClassifiedAzureRolePermissions | Select-Object -ExcludeProperty AuthorizedResourceAction, ActionType, Category -Unique | Sort-Object EAMTierLevelTagValue | Select-Object -First 1)

        } else {

            $FilteredRoleClassifications = ($ClassifiedAzureRolePermissions | Select-Object -ExcludeProperty AuthorizedResourceAction, ActionType -Unique | Sort-Object EAMTierLevelTagValue, Category)

            $RoleDefinitionClassification = [System.Collections.Generic.List[object]]::new()

            $RoleDefinitionClassification.Add($FilteredRoleClassifications)

        }

        # Mark roles with privilege escalation potential as privileged. Besides direct RBAC write access on

        # Microsoft.Authorization (role/deny assignments, elevateAccess, and Azure Policy assignments/exemptions

        # whose DeployIfNotExists/Modify effects run with a managed identity), this also covers indirect escalation

        # paths (control plane AND data plane): abusing managed identities, running code on / logging in to compute

        # that may carry a managed identity, deploying role assignments via blueprint assignments, taking over AKS

        # clusters (cluster credentials, Kubernetes RBAC data actions, or cluster reconfiguration), delegating access

        # to an external tenant via Azure Lighthouse, executing SYSTEM-context code through Azure Policy Guest

        # Configuration, and abusing Azure Automation (runbooks, DSC node configurations, and hybrid runbook workers).

        $PrivilegeEscalationActionPatterns = @(

            '^\*$'

            '^Microsoft\.Authorization/.*(\*|write|delete)$'

            '^Microsoft\.Authorization/elevateAccess/action$'

            '^Microsoft\.ManagedServices/registrationAssignments/(\*|write)$'

            '^Microsoft\.Blueprint/blueprintAssignments/(\*|write|delete)$'

            '^Microsoft\.ManagedIdentity/userAssignedIdentities/.*(write|assign/action|federatedIdentityCredentials/write)$'

            '^Microsoft\.Compute/virtualMachines/(\*|runCommand/action|extensions/write|login/action|loginAsAdmin/action)$'

            '^Microsoft\.Compute/virtualMachineScaleSets/.*(runCommand/action|extensions/write|\*)$'

            '^Microsoft\.HybridCompute/machines/(login/action|loginAsAdmin/action|runCommand/.*)$'

            '^Microsoft\.GuestConfiguration/guestConfigurationAssignments/(\*|write)$'

            '^Microsoft\.ContainerService/managedClusters/(\*|.*Credential/action|.*\*)$'

            '^Microsoft\.ContainerService/fleets/(\*|listCredentials?/action|.*\*)$'

            '^Microsoft\.App/containerApps/(exec|debug)/action$'

            '^Microsoft\.Web/sites/(\*|write)$'

            '^Microsoft\.Logic/(\*|workflows/(\*|write))$'

            '^Microsoft\.Automation/automationAccounts/(\*|runbooks/.*write|jobs/write|nodeConfigurations/write|compilationjobs/write|hybridRunbookWorkerGroups/.*)$'

        )

        # Evaluate control plane Actions (honoring NotActions) and data plane DataActions (honoring NotDataActions)

        $PrivilegeEscalationCandidates = @()

        $PrivilegeEscalationCandidates += $RoleActions | Where-Object { -not (Test-EntraOpsAzureActionExcluded -ClassifiedAction $_ -ExcludedActions $RoleNotActions) }

        $PrivilegeEscalationCandidates += $RoleDataActions | Where-Object { -not (Test-EntraOpsAzureActionExcluded -ClassifiedAction $_ -ExcludedActions $RoleNotDataActions) }

        $isPrivileged = [bool]($PrivilegeEscalationCandidates | Where-Object {

                $Action = $_

                @($PrivilegeEscalationActionPatterns | Where-Object { $Action -imatch $_ }).Count -gt 0

            })

        [PSCustomObject]@{

            "RoleId"                  = $_.Id

            "RoleName"                = $_.Name

            "IsCustom"                = $_.IsCustom

            "isPrivileged"            = $isPrivileged

            "AssignmentMode"          = $null

            "InheritsPermissionsFrom" = $null

            "RichDescription"         = $_.Description

            "RolePermissions"         = @($ClassifiedAzureRolePermissions)

            "Classification"          = $RoleDefinitionClassification

        }

    }

    $AzureRoles = $AzureRoles | Sort-Object RoleName, RoleId

    $AzureRoles | ConvertTo-Json -Depth 10 | Out-File $Exportfile -Force

}

# SIG # Begin signature block

# MIIniAYJKoZIhvcNAQcCoIIneTCCJ3UCAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCArLvNTvyQ2NWXQ

# OFW3uC+6wtfBO9yXwOPRr/PL3f3YlKCCIDwwggXJMIIEsaADAgECAhAbtY8lKt8j

# AEkoya49fu0nMA0GCSqGSIb3DQEBDAUAMH4xCzAJBgNVBAYTAlBMMSIwIAYDVQQK

# ExlVbml6ZXRvIFRlY2hub2xvZ2llcyBTLkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2Vy

# dGlmaWNhdGlvbiBBdXRob3JpdHkxIjAgBgNVBAMTGUNlcnR1bSBUcnVzdGVkIE5l

# dHdvcmsgQ0EwHhcNMjEwNTMxMDY0MzA2WhcNMjkwOTE3MDY0MzA2WjCBgDELMAkG

# A1UEBhMCUEwxIjAgBgNVBAoTGVVuaXpldG8gVGVjaG5vbG9naWVzIFMuQS4xJzAl

# BgNVBAsTHkNlcnR1bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEkMCIGA1UEAxMb

# Q2VydHVtIFRydXN0ZWQgTmV0d29yayBDQSAyMIICIjANBgkqhkiG9w0BAQEFAAOC

# Ag8AMIICCgKCAgEAvfl4+ObVgAxknYYblmRnPyI6HnUBfe/7XGeMycxca6mR5rlC

# 5SBLm9qbe7mZXdmbgEvXhEArJ9PoujC7Pgkap0mV7ytAJMKXx6fumyXvqAoAl4Va

# qp3cKcniNQfrcE1K1sGzVrihQTib0fsxf4/gX+GxPw+OFklg1waNGPmqJhCrKtPQ

# 0WeNG0a+RzDVLnLRxWPa52N5RH5LYySJhi40PylMUosqp8DikSiJucBb+R3Z5yet

# /5oCl8HGUJKbAiy9qbk0WQq/hEr/3/6zn+vZnuCYI+yma3cWKtvMrTscpIfcRnNe

# GWJoRVfkkIJCu0LW8GHgwaM9ZqNd9BjuiMmNF0UpmTJ1AjHuKSbIawLmtWJFfzcV

# WiNoidQ+3k4nsPBADLxNF8tNorMe0AZa3faTz1d1mfX6hhpneLO/lv403L3nUlbl

# s+V1e9dBkQXcXWnjlQ1DufyDljmVe2yAWk8TcsbXfSl6RLpSpCrVQUYJIP4ioLZb

# MI28iQzV13D4h1L92u+sUS4Hs07+0AnacO+Y+lbmbdu1V0vc5SwlFcieLnhO+Nqc

# noYsylfzGuXIkosagpZ6w7xQEmnYDlpGizrrJvojybawgb5CAKT41v4wLsfSRvbl

# jnX98sy50IdbzAYQYLuDNbdeZ95H7JlI8aShFf6tjGKOOVVPORa5sWOd/7cCAwEA

# AaOCAT4wggE6MA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFLahVDkCw6A/joq8

# +tT4HKbROg79MB8GA1UdIwQYMBaAFAh2zcsH/yT2xc3tu5C84oQ3RnX3MA4GA1Ud

# DwEB/wQEAwIBBjAvBgNVHR8EKDAmMCSgIqAghh5odHRwOi8vY3JsLmNlcnR1bS5w

# bC9jdG5jYS5jcmwwawYIKwYBBQUHAQEEXzBdMCgGCCsGAQUFBzABhhxodHRwOi8v

# c3ViY2Eub2NzcC1jZXJ0dW0uY29tMDEGCCsGAQUFBzAChiVodHRwOi8vcmVwb3Np

# dG9yeS5jZXJ0dW0ucGwvY3RuY2EuY2VyMDkGA1UdIAQyMDAwLgYEVR0gADAmMCQG

# CCsGAQUFBwIBFhhodHRwOi8vd3d3LmNlcnR1bS5wbC9DUFMwDQYJKoZIhvcNAQEM

# BQADggEBAFHCoVgWIhCL/IYx1MIy01z4S6Ivaj5N+KsIHu3V6PrnCA3st8YeDrJ1

# BXqxC/rXdGoABh+kzqrya33YEcARCNQOTWHFOqj6seHjmOriY/1B9ZN9DbxdkjuR

# mmW60F9MvkyNaAMQFtXx0ASKhTP5N+dbLiZpQjy6zbzUeulNndrnQ/tjUoCFBMQl

# lVXwfqefAcVbKPjgzoZwpic7Ofs4LphTZSJ1Ldf23SIikZbr3WjtP6MZl9M7JYjs

# NhI9qX7OAo0FmpKnJ25FspxihjcNpDOO16hO0EoXQ0zF8ads0h5YbBRRfopUofbv

# n3l6XYGaFpAP4bvxSgD5+d2+7arszgowggZrMIIEU6ADAgECAhBX5gfP8LabvnxC

# XoItEBa/MA0GCSqGSIb3DQEBCwUAMFYxCzAJBgNVBAYTAlBMMSEwHwYDVQQKExhB

# c3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xJDAiBgNVBAMTG0NlcnR1bSBDb2RlIFNp

# Z25pbmcgMjAyMSBDQTAeFw0yNjEwMDYwODI4MjNaFw0yNzEwMDYwODI4MjJaMIGQ

# MQswCQYDVQQGEwJERTEdMBsGA1UECAwUUmhpbmVsYW5kLVBhbGF0aW5hdGUxEjAQ

# BgNVBAcMCUxhaG5zdGVpbjEeMBwGA1UECgwVT3BlbiBTb3VyY2UgRGV2ZWxvcGVy

# MS4wLAYDVQQDDCVPcGVuIFNvdXJjZSBEZXZlbG9wZXIgVGhvbWFzIE5hdW5oZWlt

# MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAphp2ljSmVsRB6gvkEq7A

# DUMENpKZiDFoAfF1ktD1nCwaVyI+bJ0ROjHwAn4iJgS+vlBDPOUIw2GLHkiqUhOg

# HSwzg6gj45GNmt6zxsKP0zPlhMB/fb0zmz7/F7e3yfKCXLfhbHuk0Es9gJ+8Wmet

# 9StVwwSE/K0MpW06GKA9nPWyE4N/ADwigDIj9rsTKJR4cve9w8G1b3zohpUc/qMr

# onab+HVw5r9b3sOBnnaXC6zvrX4fovRz1ztwfWjRjILLoFG6mW/TuK5F2ICD3Rhl

# 9R2rJWWWhzTDMsQlzvX+/SaM74q3OFpIVNdhvtmWU9pKUBRAyYMijcDqKEFGSzrc

# 8JFmGMpP5TuroWF+N21d3px2eARvW1mV0DCfFAH+Og20SH/gVW6/ltQQEkH/z/Zt

# 49ARyJrgESLOQtlMCIYSoKISdkk4ml4VUS1E/PcbzXEYj3a7m6DOxcd3WuY03UT9

# cnk3p0LMN6LeLYAZgVY+HRloZlH+kW2SkOHNuWgtXvZhAgMBAAGjggF4MIIBdDAM

# BgNVHRMBAf8EAjAAMD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly9jY3NjYTIwMjEu

# Y3JsLmNlcnR1bS5wbC9jY3NjYTIwMjEuY3JsMHMGCCsGAQUFBwEBBGcwZTAsBggr

# BgEFBQcwAYYgaHR0cDovL2Njc2NhMjAyMS5vY3NwLWNlcnR1bS5jb20wNQYIKwYB

# BQUHMAKGKWh0dHA6Ly9yZXBvc2l0b3J5LmNlcnR1bS5wbC9jY3NjYTIwMjEuY2Vy

# MB8GA1UdIwQYMBaAFN10XUwA23ufoHTKsW73PMAywHDNMB0GA1UdDgQWBBTBvGyH

# MXj1dMbVnxuof9oP4PY7cDBLBgNVHSAERDBCMAgGBmeBDAEEATA2BgsqhGgBhvZ3

# AgUBBDAnMCUGCCsGAQUFBwIBFhlodHRwczovL3d3dy5jZXJ0dW0ucGwvQ1BTMBMG

# A1UdJQQMMAoGCCsGAQUFBwMDMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsF

# AAOCAgEAkC165c7/r6y3VeEEpNXas9bQs6ZpKPdJffHkf9xoPi4kWvAIWGc4ocG1

# DJLb18RXiDYShDmT5sb/6I08FeipKi2DNJkuOq6yOTJ3S7+hNFIZCyd6i7WKO8ea

# P5I+FAbyJP4+5coZoMg45bUa9JoocaJCm+5n7WiCfN7/EQpClW5Trm4+ZMbp7EMN

# F1uLJgGCMnN0SsoUarp7PHlqupMxMC4Uhhe+lAP2ytcSIU81L97/qjrADbLWqICk

# 9il5iGM+aZndguq/cmfH9rJj4GRZHWnG6WwnzYD9+KgYlRI6em+/9dq+IRiXe2Bs

# thUuIaFW7U2gWw8tBTEYm1UBLHdJx+L1gjJCLs5KT/wy5wU32wZxNDqPUQejUC1x

# GvU3cKqmLgRq+yNf3gFVfzqIoggyM3U9wQvnk7nBtCkpjXS2hdx4yxzcmrlWsDHr

# z6+6/jeyQySzbYUlFmKnc4n9Mw2soHOajEua5poFARVRS5KgUBuiiQ21YFNYzWBo

# qGuECaaAI/C5rGxapMJ3dAOBnHw6NLqBet+ZXBJEccX5y89MLlOQu+jDmJP8HieR

# qDLlwfhVZnw4RY8Rus43NZBwhNlVuOUXqocHKmJhKNlekda3qsJj93eQBQOxKJcc

# w5O08q9jukpH2+yzFAj+7ll33DuNUgWptogc4Awtbx3glzcEvJQwggaCMIIEaqAD

# AgECAhAo8HfBHDa9/l90MkdwJy4DMA0GCSqGSIb3DQEBDAUAMFYxCzAJBgNVBAYT

# AlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xJDAiBgNVBAMT

# G0NlcnR1bSBUaW1lc3RhbXBpbmcgMjAyMSBDQTAeFw0yNjAzMTEwNzM0NTRaFw0z

# NjAyMjcwNzM0NTRaMFAxCzAJBgNVBAYTAlBMMSEwHwYDVQQKDBhBc3NlY28gRGF0

# YSBTeXN0ZW1zIFMuQS4xHjAcBgNVBAMMFUNlcnR1bSBUaW1lc3RhbXAgMjAyNjCC

# AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALi9zfBw+xI12hi2F9uNQBNO

# STkTIi13fuh3DiWybI5392bBfJw6tO7zDs7UqP/rejVf4xFTU3XNOPsuOFkP5SPF

# snWwn3VJL+NhNhsuujvYsQtaQnvNo1wk46reTgws1L8OFEdKaxgyqT4zOQx81mLw

# NZSqXNU9Rrb9oAJWJF4Mydz+C1ebu0D0+vgM3tqAQ8TU203fqgKCPqIdHloaFqH9

# eyR+8tnpmy2hnnN59ZOtmsuHeRwf5iTOhlhf0d/qqquLOSIGPgGVL1Hj5XBUox2O

# E7tQRr+l/xxNbL6OuwBO4Aa2EbuxYg37cpXv5i2/lTL4NASB/duf9W4fjA3Ro+GP

# +bC54n2OYiM3Cq8z92ejx8F5HWO2e4/75eC95B9tMw/eq7109GDyW2+2ut5Bn0o8

# MXJTERkyystWbqcnUkomA97qfiDCwvpWuOMdfTOksXe9S+xDxOJaCbiyTivgPulx

# cT+tfQTRXBr5UwtPvc+INnafOEilzVHA11tv+pHcylryxBc08cUihf/ttqkZS0bm

# x3VxQay8uohaTp0//ECA9vYGW51SKdJMJhXvKyIdBLy8WYNchTt8yRITv9Adxg9J

# qGujh+TnP1bW3aQjFtlEl7SzgNeI8OVA/CJAWWUuRT3Au9ToOpHy/flrrknhN4he

# Ew7/6ILMv4HSsj0YZ4otAgMBAAGjggFQMIIBTDB1BggrBgEFBQcBAQRpMGcwOwYI

# KwYBBQUHMAKGL2h0dHA6Ly9zdWJjYS5yZXBvc2l0b3J5LmNlcnR1bS5wbC9jdHNj

# YTIwMjEuY2VyMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0dW0u

# Y29tMB8GA1UdIwQYMBaAFL5UAi+/QGxzQ86sCSVOnkNEGu7gMAwGA1UdEwEB/wQC

# MAAwOQYDVR0fBDIwMDAuoCygKoYoaHR0cDovL3N1YmNhLmNybC5jZXJ0dW0ucGwv

# Y3RzY2EyMDIxLmNybDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCDAOBgNVHQ8BAf8E

# BAMCB4AwIgYDVR0gBBswGTAIBgZngQwBBAIwDQYLKoRoAYb2dwIFAQswHQYDVR0O

# BBYEFCM5aiirmhKnpKfyH/lFmr+N/oIDMA0GCSqGSIb3DQEBDAUAA4ICAQBm/pOb

# rAveTqYFPCSthxNVwBHTW4TfuBQY2KGCdMlH6ALjVPYf2XARNGMTXScR0JQ2/c2L

# xLpoHHhRwxFf3d933DhFS165rYj6iPSQKm41rc9AMpTCjMdmai1aK9o870pOzTzL

# RhWFVIxm+5Qf+t4V5z14tPoUsAWdfRKD1Zzvzfe5AHlE9rxOZcGROiULxs3Edf7Z

# J8RZI0jzD9juj2oEX2XS7BVKuNCK1W0h1mjapv028yqo8UtZh5/1Ib48Yyp88BDY

# Shh5PSGUUuS5tYXVfcduIPBe3PdNTYRYdT5VNxkwLgjMzIcr/6SH2fejFJDjnCxj

# vXLuarErJg/IdI+hXdGIBDVOGv1zrkF4ktoQvFZIp5DIAYh0GwyUhc87qqn5UaYT

# j2+iyiBDSNh7aGCrkuAnqg7Qh7frhX+QhMGeJ9SpLpnG76qN85hLyjvYR6gRYiLT

# j8G4fxjqV400/buPw0rBo9yJZyq/8cGdCOLPOYf9qpefTcrZKeO9pg+UJHx8UABb

# aTqizRxm8sUSEycccCCFhIit3AI/3wGuSOADeiA676NcQ7+dsP04YvzvdN7pTZNy

# g672WpBDJdg0eItHl4yomvNeIOWh1qs4QqOW6TI8Ocsi4uSDTLorxLUDnBTwKQzz

# pxd1YUctEgRh32R0J9FkFkeEruJU94RljFr1uDCCBrkwggShoAMCAQICEQCZo4AK

# JlU7ZavcboSms+o5MA0GCSqGSIb3DQEBDAUAMIGAMQswCQYDVQQGEwJQTDEiMCAG

# A1UEChMZVW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVt

# IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSQwIgYDVQQDExtDZXJ0dW0gVHJ1c3Rl

# ZCBOZXR3b3JrIENBIDIwHhcNMjEwNTE5MDUzMjE4WhcNMzYwNTE4MDUzMjE4WjBW

# MQswCQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEu

# MSQwIgYDVQQDExtDZXJ0dW0gQ29kZSBTaWduaW5nIDIwMjEgQ0EwggIiMA0GCSqG

# SIb3DQEBAQUAA4ICDwAwggIKAoICAQCdI88EMCM7wUYs5zNzPmNdenW6vlxNur3r

# Lfi+5OZ+U3iZIB+AspO+CC/bj+taJUbMbFP1gQBJUzDUCPx7BNLgid1TyztVLn52

# NKgxxu8gpyTr6EjWyGzKU/gnIu+bHAse1LCitX3CaOE13rbuHbtrxF2tPU8f253Q

# gX6eO8yTbGps1Mg+yda3DcTsOYOhSYNCJiL+5wnjZ9weoGRtvFgMHtJg6i671OPX

# IciiHO4Lwo2p9xh/tnj+JmCQEn5QU0NxzrOiRna4kjFaA9ZcwSaG7WAxeC/xoZSx

# F1oK1UPZtKVt+yrsGKqWONoK6f5EmBOAVEK2y4ATDSkb34UD7JA32f+Rm0wsr5aj

# zftDhA5mBipVZDjHpwzv8bTKzCDUSUuUmPo1govD0RwFcTtMXcfJtm1i+P2UNXad

# PyYVKRxKQATHN3imsfBiNRdN5kiVVeqP55piqgxOkyt+HkwIA4gbmSc3hD8ke66t

# 9MjlcNg73rZZlrLHsAIV/nJ0mmgSjBI/TthoGJDydekOQ2tQD2Dup/+sKQptalDl

# ui59SerVSJg8gAeV7N/ia4mrGoiez+SqV3olVfxyLFt3o/OQOnBmjhKUANoKLYlK

# mUpKEFI0PfoT8Q1W/y6s9LTI6ekbi0igEbFUIBE8KDUGfIwnisEkBw5KcBZ3XwnH

# mfznwlKo8QIDAQABo4IBVTCCAVEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU

# 3XRdTADbe5+gdMqxbvc8wDLAcM0wHwYDVR0jBBgwFoAUtqFUOQLDoD+Oirz61Pgc

# ptE6Dv0wDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMDMDAGA1Ud

# HwQpMCcwJaAjoCGGH2h0dHA6Ly9jcmwuY2VydHVtLnBsL2N0bmNhMi5jcmwwbAYI

# KwYBBQUHAQEEYDBeMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0

# dW0uY29tMDIGCCsGAQUFBzAChiZodHRwOi8vcmVwb3NpdG9yeS5jZXJ0dW0ucGwv

# Y3RuY2EyLmNlcjA5BgNVHSAEMjAwMC4GBFUdIAAwJjAkBggrBgEFBQcCARYYaHR0

# cDovL3d3dy5jZXJ0dW0ucGwvQ1BTMA0GCSqGSIb3DQEBDAUAA4ICAQB1iFgP5Y9Q

# KJpTnxDsQ/z0O23JmoZifZdEOEmQvo/79PQg9nLF/GJe6ZiUBEyDBHMtFRK0mXj3

# Qv3gL0sYXe+PPMfwmreJHvgFGWQ7XwnfMh2YIpBrkvJnjwh8gIlNlUl4KENTK5DL

# qsYPEtRQCw7R6p4s2EtWyDDr/M58iY2UBEqfUU/ujR9NuPyKk0bEcEi62JGxauFY

# zZ/yld13fHaZskIoq2XazjaD0pQkcQiIueL0HKiohS6XgZuUtCKA7S6CHttZEsOb

# QJ1j2s0urIDdqF7xaXFVaTHKtAuMfwi0jXtF3JJphrJfc+FFILgCbX/uYBPBlbBI

# P4Ht4xxk2GmfzMn7oxPITpigQFJFWuzTMUUgdRHTxaTSKRJ/6Uh7ki/pFjf9sUAS

# WgxT69QF9Ki4JF5nBIujxZ2sOU9e1HSCJwOfK07t5nnzbs1LbHuAIGJsRJiQ6HX/

# DW1XFOlXY1rc9HufFhWU+7Uk+hFkJsfzqBz3pRO+5aI6u5abI4Qws4YaeJH7H7M8

# X/YNoaArZbV4Ql+jarKsE0+8XvC4DJB+IVcvC9Ydqahi09mjQse4fxfef0L7E3hh

# o2O3bLDM6v60rIRUCi2fJT2/IRU5ohgyTch4GuYWefSBsp5NPJh4QRTP9DC3gc5Q

# EKtbrTY0Ka87Web7/zScvLmvQBm8JDFpDjCCBrkwggShoAMCAQICEQDn/2nHOzXO

# S5Em2HR8aKWHMA0GCSqGSIb3DQEBDAUAMIGAMQswCQYDVQQGEwJQTDEiMCAGA1UE

# ChMZVW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVtIENl

# cnRpZmljYXRpb24gQXV0aG9yaXR5MSQwIgYDVQQDExtDZXJ0dW0gVHJ1c3RlZCBO

# ZXR3b3JrIENBIDIwHhcNMjEwNTE5MDUzMjA3WhcNMzYwNTE4MDUzMjA3WjBWMQsw

# CQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMSQw

# IgYDVQQDExtDZXJ0dW0gVGltZXN0YW1waW5nIDIwMjEgQ0EwggIiMA0GCSqGSIb3

# DQEBAQUAA4ICDwAwggIKAoICAQDpEh8ENe25XXrFppVBvoplf0530W0lddNmjtv4

# YSh/f7eDQKFaIqc7tHj7ox+u8vIsJZlroakUeMS3i3T8aJRC+eQs4FF0GqvkM6+W

# ZO8kmzZfxmZaBYmMLs8FktgFYCzywmXeQ1fEExflee2OpbHVk665eXRHjH7MYZIz

# Nnjl2m8Hy8ulB9mR8wL/W0v0pjKNT6G0sfrx1kk+3OGosFUb7yWNnVkWKU4qSxLv

# 16kJ6oVJ4BSbZ4xMak6JLeB8szrK9vwGDpvGDnKCUMYL3NuviwH1x4gZG0JAXU3x

# 2pOAz91JWKJSAmRy/l0s0l5bEYKolg+DMqVhlOANd8Yh5mkQWaMEvBRE/kAGzIqg

# WhwzN2OsKIVtO8mf5sPWSrvyplSABAYa13rMYnzwfg08nljZHghquCJYCa/xHK9a

# cev9UD7Y+usr15d7mrszzxhF1JOr1Mpup2chNSBlyOObhlSO16rwrffVrg/SzaKf

# SndS5swRhr8bnDqNJY9TNyEYvBYpgF95K7p0g4LguR4A++Z1nFIHWVY5v0fNVZmg

# zxD9uVo/gta3onGOQj3JCxgYx0KrCXu4yc9QiVwTFLWbNdHFSjBCt5/8Q9pLuRhV

# ocdCunhcHudMS1CGQ/Rn0+7P+fzMgWdRKfEOh/hjLrnQ8BdJiYrZNxvIOhM2aa3z

# EDHNwwIDAQABo4IBVTCCAVEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUvlQC

# L79AbHNDzqwJJU6eQ0Qa7uAwHwYDVR0jBBgwFoAUtqFUOQLDoD+Oirz61PgcptE6

# Dv0wDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMIMDAGA1UdHwQp

# MCcwJaAjoCGGH2h0dHA6Ly9jcmwuY2VydHVtLnBsL2N0bmNhMi5jcmwwbAYIKwYB

# BQUHAQEEYDBeMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0dW0u

# Y29tMDIGCCsGAQUFBzAChiZodHRwOi8vcmVwb3NpdG9yeS5jZXJ0dW0ucGwvY3Ru

# Y2EyLmNlcjA5BgNVHSAEMjAwMC4GBFUdIAAwJjAkBggrBgEFBQcCARYYaHR0cDov

# L3d3dy5jZXJ0dW0ucGwvQ1BTMA0GCSqGSIb3DQEBDAUAA4ICAQC4k1l3yUwV/ZQH

# CKCneqAs8EGTnwEUJLdDpokN/dMhKjK0rR5qX8nIIHzxpQR3TAw2IRw1Uxsr2Pli

# G3bCFqSdQTUbfaTq6V3vBzEebDru9QFjqlKnxCF2h1jhLNFFplbPJiW+JSnJTh1f

# KEqEdKdxgl9rVTvlxfEJ7exOn25MGbd/wGPwuSmMxRJVO0wnqgS7kmoJjNF9zqee

# hFSDDP8ZVkWg4EZ2tIS0M3uZmByRr+1Lkwjjt8AtW83mVnZTyTsOb+FNfwJY7DS4

# FmWhkRbgcHRetreoTirPOr/ozyDKhT8MTSTf6Lttg6s6T/u08mDWw6HK04ZRDfQ9

# sb77QV8mKgO44WGP31vXnVKoWVJpFBjPvjL8/Zck/5wXX2iqjOaLStFOR/IQki+E

# hn4zlcgVm22ZVCBPF+l8nAwUUShCtKuSU7GmZLKCmmxQMkSiWILTm8EtVD6AxnJh

# oq8EnhjEEyUoflkeRF2WhFiVQOmWTwZRr44IxWGkNJC6tTorW5rl2Zl+2e9JLPYf

# 3pStAPMDoPKIjVXd6NW2+fZrNUBeDo2eOa5Fn7Brs/HLQff5Xgris5MeUbdVgDrF

# 8uxO6cLPvZPo63j62SsNg55pTWk9fUIF9iPoRbb4QurjoY/woI1RAOKtYtTic6aA

# Jq3u83RIPpGXBSJKwx4KJAOZnCDCtTGCBqIwggaeAgEBMGowVjELMAkGA1UEBhMC

# UEwxITAfBgNVBAoTGEFzc2VjbyBEYXRhIFN5c3RlbXMgUy5BLjEkMCIGA1UEAxMb

# Q2VydHVtIENvZGUgU2lnbmluZyAyMDIxIENBAhBX5gfP8LabvnxCXoItEBa/MA0G

# CWCGSAFlAwQCAQUAoIGEMBgGCisGAQQBgjcCAQwxCjAIoAKAAKECgAAwGQYJKoZI

# hvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcC

# ARUwLwYJKoZIhvcNAQkEMSIEIBsYPZQO2AzOVHAH/B+3rzb4y7xxRB0zrp7CuVM+

# 1rq1MA0GCSqGSIb3DQEBAQUABIIBgItmm++yzX0Mac/CBM7PlPmg8b///0SoE9W8

# QZa6w1B2mmuJTqMI7vjbzdhK2emzH1MjpQEQ6p4ObBfeDbiC+5TI9VqZz2oD6D4R

# jf83kow8efFLecZvKsr0HNri5TpuD0bC375wEsDEPUkHq5SP4w2l0sZpDW66sTa0

# LFcExEtvgXQEJblcOWiNu87H29mv1QRA74C+y70FYXLrsTWc8rPkKg7eboemVthe

# jNDTfMEF3C0so9zTWFPTCk4r2DcxsgXkoz58RXxs4aRVnXHDVVl6uORAOkvSB4c2

# ZBkHAxR5ZhwO68HXj0XAjkrX7Nc3Mli7/olwvBFwIRu3YlL+ewIELxpWRhRswNZS

# J6wAn3ItUl8JnyloSKpWU/vpmgEusq8+Dfy8omdjU3E8uutepnIyVoF7NrrWiSHT

# dKLJMYlx/ZG7Fdy4lE02GRy9xjbgWUVOhH4Wc7f+s9Zdv16h9/Fztes+T0RBE+y2

# Y1E8AZ4w32KKx9NOGGLAtwpac6gSFaGCBAIwggP+BgkqhkiG9w0BCQYxggPvMIID

# 6wIBATBqMFYxCzAJBgNVBAYTAlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0

# ZW1zIFMuQS4xJDAiBgNVBAMTG0NlcnR1bSBUaW1lc3RhbXBpbmcgMjAyMSBDQQIQ

# KPB3wRw2vf5fdDJHcCcuAzANBglghkgBZQMEAgIFAKCCAVYwGgYJKoZIhvcNAQkD

# MQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjEwMTMwOTQwNThaMDcG

# CyqGSIb3DQEJEAIvMSgwJjAkMCIEIIW+kOEK0kONfMkotq9IsJqyCBd87PiwEmxY

# 05EFJcQ8MD8GCSqGSIb3DQEJBDEyBDDb21+jgTSzZJzxwlKYJT0yMHCQB9O4BO64

# ilDx4HNJOaA1pfN3URXEzzU8j7yYF5QwgZ8GCyqGSIb3DQEJEAIMMYGPMIGMMIGJ

# MIGGBBRXFGhBDKha80JO+RZKUTYQ9NONmDBuMFqkWDBWMQswCQYDVQQGEwJQTDEh

# MB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMSQwIgYDVQQDExtDZXJ0

# dW0gVGltZXN0YW1waW5nIDIwMjEgQ0ECECjwd8EcNr3+X3QyR3AnLgMwDQYJKoZI

# hvcNAQEBBQAEggIAWumPYbAKhjQdSBggZMKjIS5ecZ6Po8VGiDTgHJJB5p4qtmER

# Fq00B1uqzDwN4JEmhgHSwvRfQw2g1lZSdfaYoptenOIGRNuhvjNHt8q9px+Nm2pg

# rQ18nB3h9X5wqiY3/ZGFE2QPknAJZj1B+q6HKVHCRgWtdzfUtw3SO+jTcPmjBJtP

# OQxBiQm++W9voujuAY1Vd0nezBR8Ix3SJqUH/9u2adYf2RTwWy+Hyzer7n7Viwzr

# TlFlt9d48pP0fplqXw2wKBRqKkypYJGNYhaO2SK7YeQI78Eevc6a66J4SkyYQBGW

# uLlhLzm6nBGOn7GvKyMd+ZAZBDeAaNzOzbvxKrJ70I0r0MFaDe5U8iKs+CyO7Jin

# xziusrvAjudTlm0vDDJC1n+3Kj2+VJGYVqKDHhj+/DCXq1H14uNclearIo/D+nYj

# zQtccH1qtTLufnH0qHHos1YyT06KNU6fk6Ted4+x1MmYHIRGeWAHi/rreNbRA9dH

# v4tGAycJlQ6yFPdE2YvFC6OtJNjrEOGlEBJiQ4ytZTedCPwN9103ud4Fsen5kFRJ

# n2c+lSxZJZMkFIRG5+BSH+hiTMiKEaq2llgFHeRM917K3G7GEKkekQhe/E01/nMu

# VCQ+Q5dtquQy7SZylvV+E0Y/rmG2oFrF92QyJG9UGfqYhQJZsu0Gac+mRts=

# SIG # End signature block