Public/PrivilegedAccess/Update-EntraOpsPrivilegedAdministrativeUnit.ps1
|
<# .SYNOPSIS Updates (Restricted Management) Administrative Units based on EntraOps classification. .DESCRIPTION (Restricted Management) Administrative Units for the different Enterprise Access Levels will be updated based on the classification of EntraOps. Objects will be assigned to the corresponding Administrative Units based on the classification. .PARAMETER ApplyToAccessTierLevel Array of Access Tier Levels to be processed. Default is ControlPlane, ManagementPlane. .PARAMETER FilterObjectType Array of object types to be processed. Default is User, Group. Service Principal and application objects are not supported to be assigned to AUs. .PARAMETER RbacSystems Array of RBAC systems to be processed. Default is Azure, AzureBilling, EntraID, IdentityGovernance, DeviceManagement, ResourceApps. .PARAMETER RemovalSafetyThreshold Fraction of current members that may be removed in a single run before removals for that Administrative Unit abort. Default is 0.5 (50%). .PARAMETER ForceRemovalBeyondSafetyThreshold Apply a reviewed removal plan even when it exceeds RemovalSafetyThreshold. .PARAMETER IncludeObjectDetails Include object display names and detailed API errors in console output. Defaults to ConsoleOutput.IncludeObjectDetails from EntraOpsConfig.json. Object IDs are always shown. .EXAMPLE Update administrative units for EntraID, IdentityGovernance and ResourceApps RBAC systems with User and Group objectss Update-EntraOpsPrivilegedAdministrativeUnit -RbacSystems ("EntraID", "IdentityGovernance") -FilterObjectType ("User", "Group") -RestrictedAUMode "Selected" #> function Update-EntraOpsPrivilegedAdministrativeUnit { [CmdletBinding()] param ( [Parameter(Mandatory = $False)] [ValidateSet("ControlPlane", "ManagementPlane")] [Array]$ApplyToAccessTierLevel = ("ControlPlane", "ManagementPlane") , [Parameter(Mandatory = $False)] [ValidateSet("User", "Group")] [Array]$FilterObjectType = ("User", "Group") , [Parameter(Mandatory = $False)] [ValidateSet("Azure", "EntraID", "IdentityGovernance", "DeviceManagement", "ResourceApps", "Defender")] [Array]$RbacSystems = ("EntraID", "IdentityGovernance", "ResourceApps", "DeviceManagement", "Defender") , [Parameter(Mandatory = $False)] [ValidateSet("None", "Selected", "All")] [string]$RestrictedAuMode = "Selected" #Default value will not create RMAU for Tier0 and EntraID and Identity Governance RBACs , [Parameter(Mandatory = $False)] [string]$TenantId = (Get-EntraOpsAzContextValue -Property TenantId) , # Maximum fraction of current AU members removable per synchronization. [Parameter(Mandatory = $False)] [ValidateRange(0, 1)] [double]$RemovalSafetyThreshold = 0.5 , # Permits removals that exceed RemovalSafetyThreshold. [Parameter(Mandatory = $False)] [switch]$ForceRemovalBeyondSafetyThreshold , [Parameter(Mandatory = $False)] [boolean]$IncludeObjectDetails = [bool]$Global:EntraOpsIncludeObjectDetails , [Parameter(Mandatory = $False)] [boolean]$ApplyAdministrativeUnitAssignments = $false ) $FirstPartyApps = Invoke-WebRequest -UseBasicParsing -Method GET -Uri "https://raw.githubusercontent.com/merill/microsoft-info/main/_info/MicrosoftApps.json" | ConvertFrom-Json # Summary tracking across all AUs $SyncSummary = [System.Collections.Generic.List[psobject]]::new() $TotalAdded = 0 $TotalRemoved = 0 $TotalSkipped = 0 $WarningMessages = New-Object -TypeName "System.Collections.Generic.List[psobject]" Write-Host "" Write-Host "=========================================================" -ForegroundColor Cyan Write-Host " EntraOps - Administrative Unit Sync" -ForegroundColor Cyan Write-Host " RBAC Systems : $($RbacSystems -join ', ')" -ForegroundColor Cyan Write-Host " Access Tiers : $($ApplyToAccessTierLevel -join ', ')" -ForegroundColor Cyan Write-Host " Object Types : $($FilterObjectType -join ', ')" -ForegroundColor Cyan Write-Host "=========================================================" -ForegroundColor Cyan Write-Host "" $RbacSystemCounter = 0 foreach ($RbacSystem in $RbacSystems) { $RbacSystemCounter++ Write-Progress -Activity "Updating Administrative Units" -Status "Processing RBAC system $RbacSystemCounter of $($RbacSystems.Count): $RbacSystem" -PercentComplete (($RbacSystemCounter / $RbacSystems.Count) * 100) Write-Host "---------------------------------------------------------" -ForegroundColor DarkCyan Write-Host " RBAC System: $RbacSystem ($RbacSystemCounter/$($RbacSystems.Count))" -ForegroundColor DarkCyan Write-Host "---------------------------------------------------------" -ForegroundColor DarkCyan # Get EAM classification files if ($RbacSystem -eq "EntraID") { $ClassificationTemplateSubFolder = "AadResources" } elseif ($RbacSystem -eq "ResourceApps") { $ClassificationTemplateSubFolder = "ApiPermissions" } else { $ClassificationTemplateSubFolder = $RbacSystem } $Classification = "$DefaultFolderClassifiedEam/$RbacSystem/$($RbacSystem).json" $ClassificationTemplates = "$DefaultFolderClassification/Templates/Classification_$($ClassificationTemplateSubFolder).json" $PrivilegedEamClassificationFiles = @() $PrivilegedEamClassificationFiles = Get-ChildItem -Path $ClassificationTemplates -Filter "*.json" $PrivilegedEamClassifications = $PrivilegedEamClassificationFiles | foreach-object { Get-Content -Path $_.FullName | ConvertFrom-Json } | where-object { $_.EAMTierLevelName -in $ApplyToAccessTierLevel } | select-object -unique EAMTierLevelName, EAMTierLevelTagValue #region Assign all principals in Privileged EAM to restricted AUs $PrivilegedEam = @() $PrivilegedEam += Get-ChildItem -Path $Classification | foreach-object { Get-Content $_.FullName -Filter "*.json" | ConvertFrom-Json } $PrivilegedEam = $PrivilegedEam | Where-Object { $_.ObjectType -in $FilterObjectType } $PrivilegedEamCount = ($PrivilegedEam | Where-Object { $null -eq $_.Classification }).count if ($PrivilegedEamCount -gt 0) { Write-Warning "Numbers of objects without classification: $PrivilegedEamCount" $WarningMessages.Add([PSCustomObject]@{ Type = "UnclassifiedObjects"; Message = "$PrivilegedEamCount object(s) without classification in $RbacSystem" }) } $PrivilegedEamClassifiedObjects = $PrivilegedEam | where-object { $_.Classification.AdminTierLevel -notcontains $null -and $_.RoleSystem -eq $RbacSystem } $TierLevelIndex = 0 foreach ($TierLevel in $PrivilegedEamClassifications) { $TierLevelIndex++ Write-Progress -Activity "Updating Administrative Units" -Status "$RbacSystem - Processing tier $TierLevelIndex of $($PrivilegedEamClassifications.Count): Tier$($TierLevel.EAMTierLevelTagValue)-$($TierLevel.EAMTierLevelName)" -PercentComplete (($TierLevelIndex / $PrivilegedEamClassifications.Count) * 100) $AdminUnitId = $null $IsRestrictedManagementAu = $false $AdminUnitName = "Tier" + $TierLevel.EAMTierLevelTagValue + "-" + $TierLevel.EAMTierLevelName + "." + $RbacSystem $AuAdded = 0 $AuRemoved = 0 $AuFailed = 0 $AuSkipped = 0 $AuStatus = "OK" Write-Host "" Write-Host " AU: $AdminUnitName" -ForegroundColor White $AdministrativeUnits = @(Invoke-EntraOpsMsGraphQuery -Method "GET" -Uri "/beta/administrativeUnits?`$filter=DisplayName eq '$(ConvertTo-EntraOpsODataStringLiteral -Value $AdminUnitName)'" -DisableCache) # -AllowNotFound: a missing AU is handled by the SKIP branch below so the remaining # tiers/RBAC systems still reconcile; duplicates still throw (F-10 safety). $AdminUnit = Select-EntraOpsUniqueGraphObject -InputObject $AdministrativeUnits -ObjectDescription "administrative unit '$AdminUnitName'" -AllowNotFound $AdminUnitId = $AdminUnit.id if ($null -ne $AdminUnit) { $IsRestrictedManagementAu = $AdminUnit.isMemberManagementRestricted -eq $true } if ($null -eq $AdminUnitId) { Write-Warning " [SKIP] Could not find AU: $AdminUnitName" $WarningMessages.Add([PSCustomObject]@{ Type = "AuNotFound"; Message = "Could not find AU: $AdminUnitName" }) $SyncSummary.Add([PSCustomObject]@{ RbacSystem = $RbacSystem AdminUnit = $AdminUnitName MembersBefore = "N/A" Added = 0 Removed = 0 Failed = 0 Status = "NOT FOUND" }) continue } $EntraOpsPrivilegedObjects = @() $EntraOpsPrivilegedObjects = ($PrivilegedEamClassifiedObjects | Where-Object { $_.Classification.AdminTierLevel -contains $TierLevel.EAMTierLevelTagValue -and $_.Classification.AdminTierLevelName -contains $TierLevel.EAMTierLevelName -and $_.RoleSystem -eq $RbacSystem }) $ForeignTenantObjects = @($EntraOpsPrivilegedObjects | Where-Object { -not [string]::IsNullOrEmpty($_.ObjectTenantId) -and $_.ObjectTenantId -ne $TenantId }) if ($ForeignTenantObjects.Count -gt 0) { Write-Warning " [SKIP] Excluded $($ForeignTenantObjects.Count) object(s) not owned by tenant $TenantId" $WarningMessages.Add([PSCustomObject]@{ Type = "ForeignTenantObject"; Message = "Skipped $($ForeignTenantObjects.Count) object(s) not owned by tenant $TenantId for $AdminUnitName" }) $AuSkipped += $ForeignTenantObjects.Count $TotalSkipped += $ForeignTenantObjects.Count } $EntraOpsPrivilegedObjects = @($EntraOpsPrivilegedObjects | Where-Object { [string]::IsNullOrEmpty($_.ObjectTenantId) -or $_.ObjectTenantId -eq $TenantId }) # Exclude role-assignable and PIM-enabled groups from desired set when target AU is restricted management if ($IsRestrictedManagementAu) { # Identify PIM-enabled groups from EAM role assignment data (eligible/active members indicate PIM for Groups is enabled) $PimEnabledGroupIds = @($PrivilegedEam.RoleAssignments | Where-Object { $_.RoleAssignmentSubType -in @("Eligible member", "Active member", "Nested Eligible member") } | Select-Object -ExpandProperty TransitiveByObjectId -Unique) $ExcludedGroups = @($EntraOpsPrivilegedObjects | Where-Object { $_.ObjectType -eq 'Group' -and ($_.ObjectSubType -eq 'Role-assignable' -or $_.ObjectId -in $PimEnabledGroupIds) }) if ($ExcludedGroups.Count -gt 0) { foreach ($ExclGroup in $ExcludedGroups) { $ExclReason = if ($ExclGroup.ObjectSubType -eq 'Role-assignable') { "role-assignable" } else { "PIM-enabled" } $ExcludedGroupMessage = if ($IncludeObjectDetails) { "$ExclReason group excluded from restricted management AU ${AdminUnitName}: $($ExclGroup.ObjectDisplayName) ($($ExclGroup.ObjectId))" } else { "$ExclReason group $($ExclGroup.ObjectId) excluded from restricted management AU $AdminUnitName" } Write-Warning " [SKIP] $ExcludedGroupMessage" $WarningMessages.Add([PSCustomObject]@{ Type = "GroupExcludedFromRMAU"; Message = $ExcludedGroupMessage }) $AuSkipped++ $TotalSkipped++ } $ExcludedGroupIds = $ExcludedGroups.ObjectId $EntraOpsPrivilegedObjects = @($EntraOpsPrivilegedObjects | Where-Object { $_.ObjectId -notin $ExcludedGroupIds }) } } $CurrentAdminUnitMembers = @() $CurrentAdminUnitMembers = (Invoke-EntraOpsMsGraphQuery -Method "GET" -Uri "/beta/administrativeUnits/$($AdminUnitId)/members" -OutputType PSObject -DisableCache) $CurrentMemberCount = @($CurrentAdminUnitMembers.Id).Count $DesiredMemberCount = @($EntraOpsPrivilegedObjects.ObjectId).Count Write-Host " Current members : $CurrentMemberCount | Desired: $DesiredMemberCount" -ForegroundColor Gray # Check if AU members already exists for sync, or just adding new items if ($Null -eq $CurrentAdminUnitMembers.Id) { Write-Host " AU is empty - adding all $DesiredMemberCount objects" -ForegroundColor Yellow # Add all members to the AU foreach ($PrivObj in $EntraOpsPrivilegedObjects) { try { $AdminUnitMember = Invoke-EntraOpsMsGraphQuery -Method Get -Uri "/beta/directoryObjects/$($PrivObj.ObjectId)" -OutputType PSObject $AdminUnitMemberObjectType = $AdminUnitMember.'@odata.type'.Replace('#microsoft.graph.', '') if ($IncludeObjectDetails) { Write-Host " [+] ADD [$AdminUnitMemberObjectType] $($AdminUnitMember.displayName)" -ForegroundColor Green } else { Write-Host " [+] ADD [$AdminUnitMemberObjectType] $($PrivObj.ObjectId)" -ForegroundColor Green } $OdataBody = @{ '@odata.id' = "https://graph.microsoft.com/beta/directoryObjects/$($PrivObj.ObjectId)" } | ConvertTo-Json Invoke-EntraOpsMsGraphQuery -Method "POST" -Uri "/beta/administrativeUnits/$($AdminUnitId)/members/`$ref" -DisableCache -Body $OdataBody -OutputType PSObject -ThrowOnFailure $AuAdded++ } catch { $AddFailureMessage = if ($IncludeObjectDetails) { "FAIL ADD $($PrivObj.ObjectId) to $AdminUnitName`: $_" } else { "Failed to add object $($PrivObj.ObjectId) to $AdminUnitName" } Write-Warning " [!] $AddFailureMessage" $WarningMessages.Add([PSCustomObject]@{ Type = "ApiError"; Message = $AddFailureMessage }) $AuFailed++ } } } # Check if privileged objects exists which should be synced to existing AU elseif ($null -ne $EntraOpsPrivilegedObjects.ObjectId) { # Add or remove members from the AU which are not in scope of classification $Diff = Compare-Object $($EntraOpsPrivilegedObjects.ObjectId) $($CurrentAdminUnitMembers.Id) $ToRemove = @($Diff | Where-Object { $_.SideIndicator -eq "=>" }) $ToAdd = @($Diff | Where-Object { $_.SideIndicator -eq "<=" }) if ($Diff.Count -eq 0) { Write-Host " No changes required - AU is already in sync" -ForegroundColor DarkGreen } else { Write-Host " Delta: +$($ToAdd.Count) to add -$($ToRemove.Count) to remove" -ForegroundColor Yellow } # Enforce the configured membership-removal threshold. $SafetyCheck = Test-EntraOpsRemovalSafetyThreshold -CurrentCount @($CurrentAdminUnitMembers.Id).Count -RemovalCount $ToRemove.Count -RemovalSafetyThreshold $RemovalSafetyThreshold $SkipRemovals = $SafetyCheck.Exceeds -and -not $ForceRemovalBeyondSafetyThreshold if ($SkipRemovals) { Write-Warning " [ABORT] $($ToRemove.Count) removals exceeds $($SafetyCheck.ThresholdPercent)% safety threshold ($($SafetyCheck.RemovalThreshold) of $(@($CurrentAdminUnitMembers.Id).Count) members). This may indicate an upstream data issue. Review the delta above, then re-run with -ForceRemovalBeyondSafetyThreshold to apply." $WarningMessages.Add([PSCustomObject]@{ Type = "SafetyAbort"; Message = "Aborted $AdminUnitName`: $($ToRemove.Count) removals exceeds $($SafetyCheck.ThresholdPercent)% safety threshold ($($SafetyCheck.RemovalThreshold) of $(@($CurrentAdminUnitMembers.Id).Count) members) - re-run with -ForceRemovalBeyondSafetyThreshold to apply" }) $AuStatus = "ABORTED" } elseif ($SafetyCheck.Exceeds) { Write-Warning " [FORCED] Applying $($ToRemove.Count) removals despite exceeding the $($SafetyCheck.ThresholdPercent)% safety threshold - requested via -ForceRemovalBeyondSafetyThreshold." $WarningMessages.Add([PSCustomObject]@{ Type = "SafetyOverride"; Message = "Forced $($ToRemove.Count) removals in $AdminUnitName beyond the $($SafetyCheck.ThresholdPercent)% safety threshold" }) $AuStatus = "FORCED" } if (-not $SkipRemovals) { foreach ($Entry in $ToRemove) { try { $AdminUnitMember = Invoke-EntraOpsMsGraphQuery -Method "GET" -Uri "/beta/directoryObjects/$($Entry.InputObject)" -OutputType PSObject $MemberType = $AdminUnitMember.'@odata.type'.Replace('#microsoft.graph.', '') if ($IncludeObjectDetails) { Write-Host " [-] REM [$MemberType] $($AdminUnitMember.displayName)" -ForegroundColor Yellow } else { Write-Host " [-] REM [$MemberType] $($Entry.InputObject)" -ForegroundColor Yellow } Invoke-EntraOpsMsGraphQuery -Method "DELETE" -Uri "/beta/administrativeUnits/$($AdminUnitId)/members/$($Entry.InputObject)/`$ref" -OutputType PSObject -ThrowOnFailure $AuRemoved++ } catch { $RemoveFailureMessage = if ($IncludeObjectDetails) { "FAIL REMOVE $($Entry.InputObject) from $AdminUnitName`: $_" } else { "Failed to remove object $($Entry.InputObject) from $AdminUnitName" } Write-Warning " [!] $RemoveFailureMessage" $WarningMessages.Add([PSCustomObject]@{ Type = "ApiError"; Message = $RemoveFailureMessage }) $AuFailed++ } } } foreach ($Entry in $ToAdd) { try { $AdminUnitMember = Invoke-EntraOpsMsGraphQuery -Method GET -Uri "/beta/directoryObjects/$($Entry.InputObject)" -DisableCache -OutputType PSObject $MemberType = $AdminUnitMember.'@odata.type'.Replace('#microsoft.graph.', '') if ($IncludeObjectDetails) { Write-Host " [+] ADD [$MemberType] $($AdminUnitMember.displayName)" -ForegroundColor Green } else { Write-Host " [+] ADD [$MemberType] $($Entry.InputObject)" -ForegroundColor Green } $OdataBody = @{ '@odata.id' = "https://graph.microsoft.com/beta/directoryObjects/$($Entry.InputObject)" } | ConvertTo-Json Invoke-EntraOpsMsGraphQuery -Method "POST" -Uri "/beta/administrativeUnits/$($AdminUnitId)/members/`$ref" -DisableCache -Body $OdataBody -OutputType PSObject -ThrowOnFailure $AuAdded++ } catch { $AddFailureMessage = if ($IncludeObjectDetails) { "FAIL ADD $($Entry.InputObject) to $AdminUnitName`: $_" } else { "Failed to add object $($Entry.InputObject) to $AdminUnitName" } Write-Warning " [!] $AddFailureMessage" $WarningMessages.Add([PSCustomObject]@{ Type = "ApiError"; Message = $AddFailureMessage }) $AuFailed++ } } } # No privileged objects found for the AU, cleanup existing assignments else { Write-Warning " [SKIP] No classified objects found for $AdminUnitName. Existing members untouched for safety - remove manually if needed." $WarningMessages.Add([PSCustomObject]@{ Type = "EmptyScope"; Message = "No classified objects found for $AdminUnitName - existing members untouched" }) $AuStatus = "SKIPPED" } if ($AuFailed -gt 0) { $AuStatus = "ERRORS" } $TotalAdded += $AuAdded $TotalRemoved += $AuRemoved $SyncSummary.Add([PSCustomObject]@{ RbacSystem = $RbacSystem AdminUnit = $AdminUnitName MembersBefore = $CurrentMemberCount Added = $AuAdded Removed = $AuRemoved Failed = $AuFailed Skipped = $AuSkipped Status = $AuStatus }) } #endregion } # Final summary Write-Host "" Write-Host "=========================================================" -ForegroundColor Cyan Write-Host " Administrative Unit Sync - Complete" -ForegroundColor Cyan Write-Host " Total added : $TotalAdded" -ForegroundColor Green Write-Host " Total removed: $TotalRemoved" -ForegroundColor Yellow if ($TotalSkipped -gt 0) { Write-Host " Total skipped: $TotalSkipped" -ForegroundColor DarkYellow } if (($SyncSummary | Where-Object { $_.Failed -gt 0 }).Count -gt 0) { Write-Host " Failures : $(($SyncSummary | Measure-Object -Property Failed -Sum).Sum)" -ForegroundColor Red } Write-Host "=========================================================" -ForegroundColor Cyan Write-Host "" Show-EntraOpsWarningSummary -WarningMessages $WarningMessages -IncludeObjectDetails $IncludeObjectDetails $SyncSummary | Format-Table -AutoSize -Property RbacSystem, AdminUnit, MembersBefore, @{Name = 'Added'; Expression = { $_.Added }; Align = 'Right' }, @{Name = 'Removed'; Expression = { $_.Removed }; Align = 'Right' }, @{Name = 'Failed'; Expression = { $_.Failed }; Align = 'Right' }, @{Name = 'Skipped'; Expression = { $_.Skipped }; Align = 'Right' }, Status $FailureCount = ($SyncSummary | Measure-Object -Property Failed -Sum).Sum $AbortedCount = @($SyncSummary | Where-Object { $_.Status -eq 'ABORTED' }).Count if ($FailureCount -gt 0 -or $AbortedCount -gt 0) { $Reasons = [System.Collections.Generic.List[string]]::new() if ($FailureCount -gt 0) { $Reasons.Add("$FailureCount membership operation(s) failed") | Out-Null } if ($AbortedCount -gt 0) { $Reasons.Add("$AbortedCount AU synchronization(s) aborted by the removal safety threshold") | Out-Null } throw "Administrative Unit sync did not complete: $($Reasons -join '; '). Review the warning summary above." } } # SIG # Begin signature block # MIIniAYJKoZIhvcNAQcCoIIneTCCJ3UCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDd4koOdDK7MoSC # NruZsXfviKR0er9IWrhunU2Odba996CCIDwwggXJMIIEsaADAgECAhAbtY8lKt8j # AEkoya49fu0nMA0GCSqGSIb3DQEBDAUAMH4xCzAJBgNVBAYTAlBMMSIwIAYDVQQK # ExlVbml6ZXRvIFRlY2hub2xvZ2llcyBTLkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2Vy # dGlmaWNhdGlvbiBBdXRob3JpdHkxIjAgBgNVBAMTGUNlcnR1bSBUcnVzdGVkIE5l # dHdvcmsgQ0EwHhcNMjEwNTMxMDY0MzA2WhcNMjkwOTE3MDY0MzA2WjCBgDELMAkG # A1UEBhMCUEwxIjAgBgNVBAoTGVVuaXpldG8gVGVjaG5vbG9naWVzIFMuQS4xJzAl # BgNVBAsTHkNlcnR1bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEkMCIGA1UEAxMb # Q2VydHVtIFRydXN0ZWQgTmV0d29yayBDQSAyMIICIjANBgkqhkiG9w0BAQEFAAOC # Ag8AMIICCgKCAgEAvfl4+ObVgAxknYYblmRnPyI6HnUBfe/7XGeMycxca6mR5rlC # 5SBLm9qbe7mZXdmbgEvXhEArJ9PoujC7Pgkap0mV7ytAJMKXx6fumyXvqAoAl4Va # qp3cKcniNQfrcE1K1sGzVrihQTib0fsxf4/gX+GxPw+OFklg1waNGPmqJhCrKtPQ # 0WeNG0a+RzDVLnLRxWPa52N5RH5LYySJhi40PylMUosqp8DikSiJucBb+R3Z5yet # /5oCl8HGUJKbAiy9qbk0WQq/hEr/3/6zn+vZnuCYI+yma3cWKtvMrTscpIfcRnNe # GWJoRVfkkIJCu0LW8GHgwaM9ZqNd9BjuiMmNF0UpmTJ1AjHuKSbIawLmtWJFfzcV # WiNoidQ+3k4nsPBADLxNF8tNorMe0AZa3faTz1d1mfX6hhpneLO/lv403L3nUlbl # s+V1e9dBkQXcXWnjlQ1DufyDljmVe2yAWk8TcsbXfSl6RLpSpCrVQUYJIP4ioLZb # MI28iQzV13D4h1L92u+sUS4Hs07+0AnacO+Y+lbmbdu1V0vc5SwlFcieLnhO+Nqc # noYsylfzGuXIkosagpZ6w7xQEmnYDlpGizrrJvojybawgb5CAKT41v4wLsfSRvbl # jnX98sy50IdbzAYQYLuDNbdeZ95H7JlI8aShFf6tjGKOOVVPORa5sWOd/7cCAwEA # AaOCAT4wggE6MA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFLahVDkCw6A/joq8 # +tT4HKbROg79MB8GA1UdIwQYMBaAFAh2zcsH/yT2xc3tu5C84oQ3RnX3MA4GA1Ud # DwEB/wQEAwIBBjAvBgNVHR8EKDAmMCSgIqAghh5odHRwOi8vY3JsLmNlcnR1bS5w # bC9jdG5jYS5jcmwwawYIKwYBBQUHAQEEXzBdMCgGCCsGAQUFBzABhhxodHRwOi8v # c3ViY2Eub2NzcC1jZXJ0dW0uY29tMDEGCCsGAQUFBzAChiVodHRwOi8vcmVwb3Np # dG9yeS5jZXJ0dW0ucGwvY3RuY2EuY2VyMDkGA1UdIAQyMDAwLgYEVR0gADAmMCQG # CCsGAQUFBwIBFhhodHRwOi8vd3d3LmNlcnR1bS5wbC9DUFMwDQYJKoZIhvcNAQEM # BQADggEBAFHCoVgWIhCL/IYx1MIy01z4S6Ivaj5N+KsIHu3V6PrnCA3st8YeDrJ1 # BXqxC/rXdGoABh+kzqrya33YEcARCNQOTWHFOqj6seHjmOriY/1B9ZN9DbxdkjuR # mmW60F9MvkyNaAMQFtXx0ASKhTP5N+dbLiZpQjy6zbzUeulNndrnQ/tjUoCFBMQl # lVXwfqefAcVbKPjgzoZwpic7Ofs4LphTZSJ1Ldf23SIikZbr3WjtP6MZl9M7JYjs # NhI9qX7OAo0FmpKnJ25FspxihjcNpDOO16hO0EoXQ0zF8ads0h5YbBRRfopUofbv # n3l6XYGaFpAP4bvxSgD5+d2+7arszgowggZrMIIEU6ADAgECAhBX5gfP8LabvnxC # XoItEBa/MA0GCSqGSIb3DQEBCwUAMFYxCzAJBgNVBAYTAlBMMSEwHwYDVQQKExhB # c3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xJDAiBgNVBAMTG0NlcnR1bSBDb2RlIFNp # Z25pbmcgMjAyMSBDQTAeFw0yNjEwMDYwODI4MjNaFw0yNzEwMDYwODI4MjJaMIGQ # MQswCQYDVQQGEwJERTEdMBsGA1UECAwUUmhpbmVsYW5kLVBhbGF0aW5hdGUxEjAQ # BgNVBAcMCUxhaG5zdGVpbjEeMBwGA1UECgwVT3BlbiBTb3VyY2UgRGV2ZWxvcGVy # MS4wLAYDVQQDDCVPcGVuIFNvdXJjZSBEZXZlbG9wZXIgVGhvbWFzIE5hdW5oZWlt # MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAphp2ljSmVsRB6gvkEq7A # DUMENpKZiDFoAfF1ktD1nCwaVyI+bJ0ROjHwAn4iJgS+vlBDPOUIw2GLHkiqUhOg # HSwzg6gj45GNmt6zxsKP0zPlhMB/fb0zmz7/F7e3yfKCXLfhbHuk0Es9gJ+8Wmet # 9StVwwSE/K0MpW06GKA9nPWyE4N/ADwigDIj9rsTKJR4cve9w8G1b3zohpUc/qMr # onab+HVw5r9b3sOBnnaXC6zvrX4fovRz1ztwfWjRjILLoFG6mW/TuK5F2ICD3Rhl # 9R2rJWWWhzTDMsQlzvX+/SaM74q3OFpIVNdhvtmWU9pKUBRAyYMijcDqKEFGSzrc # 8JFmGMpP5TuroWF+N21d3px2eARvW1mV0DCfFAH+Og20SH/gVW6/ltQQEkH/z/Zt # 49ARyJrgESLOQtlMCIYSoKISdkk4ml4VUS1E/PcbzXEYj3a7m6DOxcd3WuY03UT9 # cnk3p0LMN6LeLYAZgVY+HRloZlH+kW2SkOHNuWgtXvZhAgMBAAGjggF4MIIBdDAM # BgNVHRMBAf8EAjAAMD0GA1UdHwQ2MDQwMqAwoC6GLGh0dHA6Ly9jY3NjYTIwMjEu # Y3JsLmNlcnR1bS5wbC9jY3NjYTIwMjEuY3JsMHMGCCsGAQUFBwEBBGcwZTAsBggr # BgEFBQcwAYYgaHR0cDovL2Njc2NhMjAyMS5vY3NwLWNlcnR1bS5jb20wNQYIKwYB # BQUHMAKGKWh0dHA6Ly9yZXBvc2l0b3J5LmNlcnR1bS5wbC9jY3NjYTIwMjEuY2Vy # MB8GA1UdIwQYMBaAFN10XUwA23ufoHTKsW73PMAywHDNMB0GA1UdDgQWBBTBvGyH # MXj1dMbVnxuof9oP4PY7cDBLBgNVHSAERDBCMAgGBmeBDAEEATA2BgsqhGgBhvZ3 # AgUBBDAnMCUGCCsGAQUFBwIBFhlodHRwczovL3d3dy5jZXJ0dW0ucGwvQ1BTMBMG # A1UdJQQMMAoGCCsGAQUFBwMDMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsF # AAOCAgEAkC165c7/r6y3VeEEpNXas9bQs6ZpKPdJffHkf9xoPi4kWvAIWGc4ocG1 # DJLb18RXiDYShDmT5sb/6I08FeipKi2DNJkuOq6yOTJ3S7+hNFIZCyd6i7WKO8ea # P5I+FAbyJP4+5coZoMg45bUa9JoocaJCm+5n7WiCfN7/EQpClW5Trm4+ZMbp7EMN # F1uLJgGCMnN0SsoUarp7PHlqupMxMC4Uhhe+lAP2ytcSIU81L97/qjrADbLWqICk # 9il5iGM+aZndguq/cmfH9rJj4GRZHWnG6WwnzYD9+KgYlRI6em+/9dq+IRiXe2Bs # thUuIaFW7U2gWw8tBTEYm1UBLHdJx+L1gjJCLs5KT/wy5wU32wZxNDqPUQejUC1x # GvU3cKqmLgRq+yNf3gFVfzqIoggyM3U9wQvnk7nBtCkpjXS2hdx4yxzcmrlWsDHr # z6+6/jeyQySzbYUlFmKnc4n9Mw2soHOajEua5poFARVRS5KgUBuiiQ21YFNYzWBo # qGuECaaAI/C5rGxapMJ3dAOBnHw6NLqBet+ZXBJEccX5y89MLlOQu+jDmJP8HieR # qDLlwfhVZnw4RY8Rus43NZBwhNlVuOUXqocHKmJhKNlekda3qsJj93eQBQOxKJcc # w5O08q9jukpH2+yzFAj+7ll33DuNUgWptogc4Awtbx3glzcEvJQwggaCMIIEaqAD # AgECAhAo8HfBHDa9/l90MkdwJy4DMA0GCSqGSIb3DQEBDAUAMFYxCzAJBgNVBAYT # AlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0ZW1zIFMuQS4xJDAiBgNVBAMT # G0NlcnR1bSBUaW1lc3RhbXBpbmcgMjAyMSBDQTAeFw0yNjAzMTEwNzM0NTRaFw0z # NjAyMjcwNzM0NTRaMFAxCzAJBgNVBAYTAlBMMSEwHwYDVQQKDBhBc3NlY28gRGF0 # YSBTeXN0ZW1zIFMuQS4xHjAcBgNVBAMMFUNlcnR1bSBUaW1lc3RhbXAgMjAyNjCC # AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALi9zfBw+xI12hi2F9uNQBNO # STkTIi13fuh3DiWybI5392bBfJw6tO7zDs7UqP/rejVf4xFTU3XNOPsuOFkP5SPF # snWwn3VJL+NhNhsuujvYsQtaQnvNo1wk46reTgws1L8OFEdKaxgyqT4zOQx81mLw # NZSqXNU9Rrb9oAJWJF4Mydz+C1ebu0D0+vgM3tqAQ8TU203fqgKCPqIdHloaFqH9 # eyR+8tnpmy2hnnN59ZOtmsuHeRwf5iTOhlhf0d/qqquLOSIGPgGVL1Hj5XBUox2O # E7tQRr+l/xxNbL6OuwBO4Aa2EbuxYg37cpXv5i2/lTL4NASB/duf9W4fjA3Ro+GP # +bC54n2OYiM3Cq8z92ejx8F5HWO2e4/75eC95B9tMw/eq7109GDyW2+2ut5Bn0o8 # MXJTERkyystWbqcnUkomA97qfiDCwvpWuOMdfTOksXe9S+xDxOJaCbiyTivgPulx # cT+tfQTRXBr5UwtPvc+INnafOEilzVHA11tv+pHcylryxBc08cUihf/ttqkZS0bm # x3VxQay8uohaTp0//ECA9vYGW51SKdJMJhXvKyIdBLy8WYNchTt8yRITv9Adxg9J # qGujh+TnP1bW3aQjFtlEl7SzgNeI8OVA/CJAWWUuRT3Au9ToOpHy/flrrknhN4he # Ew7/6ILMv4HSsj0YZ4otAgMBAAGjggFQMIIBTDB1BggrBgEFBQcBAQRpMGcwOwYI # KwYBBQUHMAKGL2h0dHA6Ly9zdWJjYS5yZXBvc2l0b3J5LmNlcnR1bS5wbC9jdHNj # YTIwMjEuY2VyMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0dW0u # Y29tMB8GA1UdIwQYMBaAFL5UAi+/QGxzQ86sCSVOnkNEGu7gMAwGA1UdEwEB/wQC # MAAwOQYDVR0fBDIwMDAuoCygKoYoaHR0cDovL3N1YmNhLmNybC5jZXJ0dW0ucGwv # Y3RzY2EyMDIxLmNybDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDCDAOBgNVHQ8BAf8E # BAMCB4AwIgYDVR0gBBswGTAIBgZngQwBBAIwDQYLKoRoAYb2dwIFAQswHQYDVR0O # BBYEFCM5aiirmhKnpKfyH/lFmr+N/oIDMA0GCSqGSIb3DQEBDAUAA4ICAQBm/pOb # rAveTqYFPCSthxNVwBHTW4TfuBQY2KGCdMlH6ALjVPYf2XARNGMTXScR0JQ2/c2L # xLpoHHhRwxFf3d933DhFS165rYj6iPSQKm41rc9AMpTCjMdmai1aK9o870pOzTzL # RhWFVIxm+5Qf+t4V5z14tPoUsAWdfRKD1Zzvzfe5AHlE9rxOZcGROiULxs3Edf7Z # J8RZI0jzD9juj2oEX2XS7BVKuNCK1W0h1mjapv028yqo8UtZh5/1Ib48Yyp88BDY # Shh5PSGUUuS5tYXVfcduIPBe3PdNTYRYdT5VNxkwLgjMzIcr/6SH2fejFJDjnCxj # vXLuarErJg/IdI+hXdGIBDVOGv1zrkF4ktoQvFZIp5DIAYh0GwyUhc87qqn5UaYT # j2+iyiBDSNh7aGCrkuAnqg7Qh7frhX+QhMGeJ9SpLpnG76qN85hLyjvYR6gRYiLT # j8G4fxjqV400/buPw0rBo9yJZyq/8cGdCOLPOYf9qpefTcrZKeO9pg+UJHx8UABb # aTqizRxm8sUSEycccCCFhIit3AI/3wGuSOADeiA676NcQ7+dsP04YvzvdN7pTZNy # g672WpBDJdg0eItHl4yomvNeIOWh1qs4QqOW6TI8Ocsi4uSDTLorxLUDnBTwKQzz # pxd1YUctEgRh32R0J9FkFkeEruJU94RljFr1uDCCBrkwggShoAMCAQICEQCZo4AK # JlU7ZavcboSms+o5MA0GCSqGSIb3DQEBDAUAMIGAMQswCQYDVQQGEwJQTDEiMCAG # A1UEChMZVW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVt # IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MSQwIgYDVQQDExtDZXJ0dW0gVHJ1c3Rl # ZCBOZXR3b3JrIENBIDIwHhcNMjEwNTE5MDUzMjE4WhcNMzYwNTE4MDUzMjE4WjBW # MQswCQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEu # MSQwIgYDVQQDExtDZXJ0dW0gQ29kZSBTaWduaW5nIDIwMjEgQ0EwggIiMA0GCSqG # SIb3DQEBAQUAA4ICDwAwggIKAoICAQCdI88EMCM7wUYs5zNzPmNdenW6vlxNur3r # Lfi+5OZ+U3iZIB+AspO+CC/bj+taJUbMbFP1gQBJUzDUCPx7BNLgid1TyztVLn52 # NKgxxu8gpyTr6EjWyGzKU/gnIu+bHAse1LCitX3CaOE13rbuHbtrxF2tPU8f253Q # gX6eO8yTbGps1Mg+yda3DcTsOYOhSYNCJiL+5wnjZ9weoGRtvFgMHtJg6i671OPX # IciiHO4Lwo2p9xh/tnj+JmCQEn5QU0NxzrOiRna4kjFaA9ZcwSaG7WAxeC/xoZSx # F1oK1UPZtKVt+yrsGKqWONoK6f5EmBOAVEK2y4ATDSkb34UD7JA32f+Rm0wsr5aj # zftDhA5mBipVZDjHpwzv8bTKzCDUSUuUmPo1govD0RwFcTtMXcfJtm1i+P2UNXad # PyYVKRxKQATHN3imsfBiNRdN5kiVVeqP55piqgxOkyt+HkwIA4gbmSc3hD8ke66t # 9MjlcNg73rZZlrLHsAIV/nJ0mmgSjBI/TthoGJDydekOQ2tQD2Dup/+sKQptalDl # ui59SerVSJg8gAeV7N/ia4mrGoiez+SqV3olVfxyLFt3o/OQOnBmjhKUANoKLYlK # mUpKEFI0PfoT8Q1W/y6s9LTI6ekbi0igEbFUIBE8KDUGfIwnisEkBw5KcBZ3XwnH # mfznwlKo8QIDAQABo4IBVTCCAVEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU # 3XRdTADbe5+gdMqxbvc8wDLAcM0wHwYDVR0jBBgwFoAUtqFUOQLDoD+Oirz61Pgc # ptE6Dv0wDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMDMDAGA1Ud # HwQpMCcwJaAjoCGGH2h0dHA6Ly9jcmwuY2VydHVtLnBsL2N0bmNhMi5jcmwwbAYI # KwYBBQUHAQEEYDBeMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0 # dW0uY29tMDIGCCsGAQUFBzAChiZodHRwOi8vcmVwb3NpdG9yeS5jZXJ0dW0ucGwv # Y3RuY2EyLmNlcjA5BgNVHSAEMjAwMC4GBFUdIAAwJjAkBggrBgEFBQcCARYYaHR0 # cDovL3d3dy5jZXJ0dW0ucGwvQ1BTMA0GCSqGSIb3DQEBDAUAA4ICAQB1iFgP5Y9Q # KJpTnxDsQ/z0O23JmoZifZdEOEmQvo/79PQg9nLF/GJe6ZiUBEyDBHMtFRK0mXj3 # Qv3gL0sYXe+PPMfwmreJHvgFGWQ7XwnfMh2YIpBrkvJnjwh8gIlNlUl4KENTK5DL # qsYPEtRQCw7R6p4s2EtWyDDr/M58iY2UBEqfUU/ujR9NuPyKk0bEcEi62JGxauFY # zZ/yld13fHaZskIoq2XazjaD0pQkcQiIueL0HKiohS6XgZuUtCKA7S6CHttZEsOb # QJ1j2s0urIDdqF7xaXFVaTHKtAuMfwi0jXtF3JJphrJfc+FFILgCbX/uYBPBlbBI # P4Ht4xxk2GmfzMn7oxPITpigQFJFWuzTMUUgdRHTxaTSKRJ/6Uh7ki/pFjf9sUAS # WgxT69QF9Ki4JF5nBIujxZ2sOU9e1HSCJwOfK07t5nnzbs1LbHuAIGJsRJiQ6HX/ # DW1XFOlXY1rc9HufFhWU+7Uk+hFkJsfzqBz3pRO+5aI6u5abI4Qws4YaeJH7H7M8 # X/YNoaArZbV4Ql+jarKsE0+8XvC4DJB+IVcvC9Ydqahi09mjQse4fxfef0L7E3hh # o2O3bLDM6v60rIRUCi2fJT2/IRU5ohgyTch4GuYWefSBsp5NPJh4QRTP9DC3gc5Q # EKtbrTY0Ka87Web7/zScvLmvQBm8JDFpDjCCBrkwggShoAMCAQICEQDn/2nHOzXO # S5Em2HR8aKWHMA0GCSqGSIb3DQEBDAUAMIGAMQswCQYDVQQGEwJQTDEiMCAGA1UE # ChMZVW5pemV0byBUZWNobm9sb2dpZXMgUy5BLjEnMCUGA1UECxMeQ2VydHVtIENl # cnRpZmljYXRpb24gQXV0aG9yaXR5MSQwIgYDVQQDExtDZXJ0dW0gVHJ1c3RlZCBO # ZXR3b3JrIENBIDIwHhcNMjEwNTE5MDUzMjA3WhcNMzYwNTE4MDUzMjA3WjBWMQsw # CQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMSQw # IgYDVQQDExtDZXJ0dW0gVGltZXN0YW1waW5nIDIwMjEgQ0EwggIiMA0GCSqGSIb3 # DQEBAQUAA4ICDwAwggIKAoICAQDpEh8ENe25XXrFppVBvoplf0530W0lddNmjtv4 # YSh/f7eDQKFaIqc7tHj7ox+u8vIsJZlroakUeMS3i3T8aJRC+eQs4FF0GqvkM6+W # ZO8kmzZfxmZaBYmMLs8FktgFYCzywmXeQ1fEExflee2OpbHVk665eXRHjH7MYZIz # Nnjl2m8Hy8ulB9mR8wL/W0v0pjKNT6G0sfrx1kk+3OGosFUb7yWNnVkWKU4qSxLv # 16kJ6oVJ4BSbZ4xMak6JLeB8szrK9vwGDpvGDnKCUMYL3NuviwH1x4gZG0JAXU3x # 2pOAz91JWKJSAmRy/l0s0l5bEYKolg+DMqVhlOANd8Yh5mkQWaMEvBRE/kAGzIqg # WhwzN2OsKIVtO8mf5sPWSrvyplSABAYa13rMYnzwfg08nljZHghquCJYCa/xHK9a # cev9UD7Y+usr15d7mrszzxhF1JOr1Mpup2chNSBlyOObhlSO16rwrffVrg/SzaKf # SndS5swRhr8bnDqNJY9TNyEYvBYpgF95K7p0g4LguR4A++Z1nFIHWVY5v0fNVZmg # zxD9uVo/gta3onGOQj3JCxgYx0KrCXu4yc9QiVwTFLWbNdHFSjBCt5/8Q9pLuRhV # ocdCunhcHudMS1CGQ/Rn0+7P+fzMgWdRKfEOh/hjLrnQ8BdJiYrZNxvIOhM2aa3z # EDHNwwIDAQABo4IBVTCCAVEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUvlQC # L79AbHNDzqwJJU6eQ0Qa7uAwHwYDVR0jBBgwFoAUtqFUOQLDoD+Oirz61PgcptE6 # Dv0wDgYDVR0PAQH/BAQDAgEGMBMGA1UdJQQMMAoGCCsGAQUFBwMIMDAGA1UdHwQp # MCcwJaAjoCGGH2h0dHA6Ly9jcmwuY2VydHVtLnBsL2N0bmNhMi5jcmwwbAYIKwYB # BQUHAQEEYDBeMCgGCCsGAQUFBzABhhxodHRwOi8vc3ViY2Eub2NzcC1jZXJ0dW0u # Y29tMDIGCCsGAQUFBzAChiZodHRwOi8vcmVwb3NpdG9yeS5jZXJ0dW0ucGwvY3Ru # Y2EyLmNlcjA5BgNVHSAEMjAwMC4GBFUdIAAwJjAkBggrBgEFBQcCARYYaHR0cDov # L3d3dy5jZXJ0dW0ucGwvQ1BTMA0GCSqGSIb3DQEBDAUAA4ICAQC4k1l3yUwV/ZQH # CKCneqAs8EGTnwEUJLdDpokN/dMhKjK0rR5qX8nIIHzxpQR3TAw2IRw1Uxsr2Pli # G3bCFqSdQTUbfaTq6V3vBzEebDru9QFjqlKnxCF2h1jhLNFFplbPJiW+JSnJTh1f # KEqEdKdxgl9rVTvlxfEJ7exOn25MGbd/wGPwuSmMxRJVO0wnqgS7kmoJjNF9zqee # hFSDDP8ZVkWg4EZ2tIS0M3uZmByRr+1Lkwjjt8AtW83mVnZTyTsOb+FNfwJY7DS4 # FmWhkRbgcHRetreoTirPOr/ozyDKhT8MTSTf6Lttg6s6T/u08mDWw6HK04ZRDfQ9 # sb77QV8mKgO44WGP31vXnVKoWVJpFBjPvjL8/Zck/5wXX2iqjOaLStFOR/IQki+E # hn4zlcgVm22ZVCBPF+l8nAwUUShCtKuSU7GmZLKCmmxQMkSiWILTm8EtVD6AxnJh # oq8EnhjEEyUoflkeRF2WhFiVQOmWTwZRr44IxWGkNJC6tTorW5rl2Zl+2e9JLPYf # 3pStAPMDoPKIjVXd6NW2+fZrNUBeDo2eOa5Fn7Brs/HLQff5Xgris5MeUbdVgDrF # 8uxO6cLPvZPo63j62SsNg55pTWk9fUIF9iPoRbb4QurjoY/woI1RAOKtYtTic6aA # Jq3u83RIPpGXBSJKwx4KJAOZnCDCtTGCBqIwggaeAgEBMGowVjELMAkGA1UEBhMC # UEwxITAfBgNVBAoTGEFzc2VjbyBEYXRhIFN5c3RlbXMgUy5BLjEkMCIGA1UEAxMb # Q2VydHVtIENvZGUgU2lnbmluZyAyMDIxIENBAhBX5gfP8LabvnxCXoItEBa/MA0G # CWCGSAFlAwQCAQUAoIGEMBgGCisGAQQBgjcCAQwxCjAIoAKAAKECgAAwGQYJKoZI # hvcNAQkDMQwGCisGAQQBgjcCAQQwHAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcC # ARUwLwYJKoZIhvcNAQkEMSIEIDsYTyuDsdFuIJwXqnBJ0CvEaZOwNXzPkLpbL35B # H5WcMA0GCSqGSIb3DQEBAQUABIIBgFHdNDTZsA2d49O899jC5A5jaZwl5yr7nPLd # AhcBqPmqrB9VMoUqzAAP0ecUjMWx4z/8xqbJ3yXw7bd9vZOey42qomwBH1bloq2K # 1n2+sgXClGC8qfzwXv9ILLNbwqL7urlweRDrWzh+fM5Ar2jgnAwsK81xlhQmVrOY # y06cEmPAjIZTQUboUkbVnG3vY94HylHHHM9v4yEfILThQhl0bOpZI8cw1jjVq60J # s4DWi3/rOXBnT1YqEbu2AhlWs+Bz9IMy/DaG48OXrIeRwVI66YaIPyF8IsDZjGHw # BLHNR+dgQqf/rFjg8Ow5FBnZx1l/2dCH4wy0wLfiXCUa5Gm3YSmb8bp6JSCCntam # Qhcu724mV4Pw+dB7q5+FCUTVz1xv9KQbAEvLynhQO5QmFK19XJ6ff0RcrCXZUDX9 # xk6zHmqhghFb2gqozbTjbaNsjESJm6V78CxrDUOonWODqjtbyZkLyf+Quhuq5gPL # CeswqyZK2E7kmhwkfJQ3kIhN9IUi76GCBAIwggP+BgkqhkiG9w0BCQYxggPvMIID # 6wIBATBqMFYxCzAJBgNVBAYTAlBMMSEwHwYDVQQKExhBc3NlY28gRGF0YSBTeXN0 # ZW1zIFMuQS4xJDAiBgNVBAMTG0NlcnR1bSBUaW1lc3RhbXBpbmcgMjAyMSBDQQIQ # KPB3wRw2vf5fdDJHcCcuAzANBglghkgBZQMEAgIFAKCCAVYwGgYJKoZIhvcNAQkD # MQ0GCyqGSIb3DQEJEAEEMBwGCSqGSIb3DQEJBTEPFw0yNjEwMTMwOTQxNDJaMDcG # CyqGSIb3DQEJEAIvMSgwJjAkMCIEIIW+kOEK0kONfMkotq9IsJqyCBd87PiwEmxY # 05EFJcQ8MD8GCSqGSIb3DQEJBDEyBDCqMMeA9PlSFEnsXKq82bRe0joQ58nhBtSi # VErFYIbjqarH/EmZwoPXPFYZVU1Zp3QwgZ8GCyqGSIb3DQEJEAIMMYGPMIGMMIGJ # MIGGBBRXFGhBDKha80JO+RZKUTYQ9NONmDBuMFqkWDBWMQswCQYDVQQGEwJQTDEh # MB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMSQwIgYDVQQDExtDZXJ0 # dW0gVGltZXN0YW1waW5nIDIwMjEgQ0ECECjwd8EcNr3+X3QyR3AnLgMwDQYJKoZI # hvcNAQEBBQAEggIAdNO1s0dmbGDqKspYeUT6lYU3JOfwv90yXLA4iVgRSarPPgBN # jRpgwrGVPrK6whxf5QCHYAwBJjrd1H27U45k4YVORSg4MqlWH16FPtSSRlutljXn # S5ZDWsgJIlG6HGB20yRmS+WZ6liZwqJn4pRqF4u7P6GSkQoj0fSuIuK5Dvw8Na3w # cNwgnPsxX/nRKnR2Hspqydskr57SOyFxsO3Qo+yXj5fyEjrLRflzma3nRKbGfgKl # eXbqdUHiMUqbSFPVN6Sxt0kd124N/66xRE0oUr98d1VPUQ5lUUQLs3WofNNvM3EA # 7KCgRkZeRqIpZXEt0m5TxY2iLZ+beDY0e+UPKdGuq/y7X813ofX4gCtwor5zNuC7 # Oj0tzKUutpjPp9MiLJGaXnUz2kS5+VrchZbovCOjX+1+h4NEip8JkTZO2ZyqpEl4 # rs41kAXljtP4SF/EdOmvx6S92ElJg9ycMuElEDwVzeXq1O1TRbuYljn5Zept+dwq # R/A9Jt0/nmd8vp/b+nV4JtgMbQGjo+MrA+DhxWk56eWQiO0wCuYgF5LkwwinDbbi # 2oLjBB11TpDwdI5jJblruZ/7EKMEWk9mlN6dfiQEL2btVnOFUeMJR7WwA4iwvsLQ # J6YH0iPvzDZdbLqTiG/RxDCj67epccqgdJiNP+iWoFKc0pdxhlJC6kJfVGE= # SIG # End signature block |