Get-NdesNtlmDisclosure

1.2

Get-NdesNtlmDisclosure.ps1

                                <#PSScriptInfo

.VERSION 1.2

.GUID c5c64ed4-9898-4369-a5b1-eabb478bcbac

.AUTHOR Richard Hicks

.COMPANYNAME Richard M. Hicks Consulting, Inc.

.COPYRIGHT Copyright (C) 2026 Richard M. Hicks Consulting, Inc. All Rights Reserved.

.LICENSE Licensed under the MIT License. See LICENSE file in the project root for full license information.

.LICENSEURI https://github.com/richardhicks/ndesntlm/blob/main/LICENSE

.PROJECTURI https://github.com/richardhicks/ndesntlm

.TAGS PKI, certificates, Intune, Microsoft, NDES, SCEP, NTLM, ADCS

#>

<#

.SYNOPSIS

    Tests a Network Device Enrollment Service (NDES) server for NTLM information disclosure.

.DESCRIPTION

    Sends an unauthenticated NTLM type-1 (negotiate) message to the NDES SCEP administration

    endpoint and inspects the server's NTLM type-2 (challenge) response. When NTLM is enabled,

    the type-2 challenge leaks sensitive host and domain details in its TargetInfo block,

    including the server's NetBIOS and DNS computer names, the NetBIOS and DNS domain names,

    the DNS forest name, and the operating system version.

    This information disclosure occurs without any authentication and can be used by an

    attacker to enumerate an organization's internal Active Directory namespace. The script

    surfaces exactly what an unauthenticated client can retrieve so the exposure can be

    assessed and remediated (for example, by disabling NTLM on the NDES endpoint).

    The request is always sent over HTTPS to the default NDES SCEP administration endpoint

    (/certsrv/mscep_admin), which is the resource that presents the NTLM challenge.

.PARAMETER ComputerName

    One or more fully qualified domain names (FQDNs) of the NDES servers to test. The script

    sends the request over HTTPS to the /certsrv/mscep_admin path on each host. This parameter

    accepts a comma-separated list and can be supplied from the pipeline.

.PARAMETER SkipCertificateCheck

    Bypasses TLS certificate validation (curl -k). Use this when the NDES server presents a

    self-signed or otherwise untrusted certificate.

.INPUTS

    System.String

    An NDES server FQDN can be piped to this script.

.OUTPUTS

    System.Management.Automation.PSCustomObject

    A single, consistently shaped object per target with the following properties: Target,

    Status, NetBIOS Computer Name, NetBIOS Domain Name, DNS Computer Name, DNS Domain Name,

    DNS Forest Name, and OS Version. Status describes the outcome (information disclosed, no

    NTLM challenge offered, or an inconclusive/invalid response). The disclosure fields are

    populated when the server leaks them and are $null otherwise. Because every result shares

    the same shape, piping multiple servers renders as one uniform table.

.EXAMPLE

    .\Get-NdesNtlmDisclosure.ps1 -ComputerName ndes.corp.example.com

    Tests the NDES administration endpoint on the specified server over HTTPS and returns any

    disclosed host and domain information.

.EXAMPLE

    .\Get-NdesNtlmDisclosure.ps1 -ComputerName ndes.corp.example.com -SkipCertificateCheck

    Tests the NDES server while ignoring TLS certificate validation errors, which is useful

    when the server presents a self-signed or untrusted certificate.

.EXAMPLE

    .\Get-NdesNtlmDisclosure.ps1 -ComputerName ndes1.corp.example.com, ndes2.corp.example.com, ndes3.corp.example.com

    Tests multiple NDES servers by passing a comma-separated list of FQDNs.

.EXAMPLE

    'ndes1.corp.example.com', 'ndes2.corp.example.com' | .\Get-NdesNtlmDisclosure.ps1

    Tests multiple NDES servers by piping their FQDNs to the script.

.LINK

    https://www.richardhicks.com/

.NOTES

    Version:        1.2

    Creation Date:  August 15, 2026

    Last Updated:   August 16, 2026

    Author:         Richard Hicks

    Organization:   Richard M. Hicks Consulting, Inc.

    Contact:        rich@richardhicks.com

    Website:        https://www.richardhicks.com/

#>

#Requires -Version 5.1

[CmdletBinding()]

Param (

    [Parameter(Mandatory, ValueFromPipeline, ValueFromPipelineByPropertyName, HelpMessage = 'Enter the fully qualified domain name (FQDN) of the NDES server')]

    [ValidateNotNullOrEmpty()]

    [string[]]$ComputerName,

    [switch]$SkipCertificateCheck

)

Process {

    ForEach ($Computer in $ComputerName) {

        # Build the target from the supplied FQDN. The request is always sent over HTTPS to the default NDES SCEP

        # administration endpoint (/certsrv/mscep_admin), which is the resource that presents the NTLM challenge

        $Target = [uri]"https://$Computer/certsrv/mscep_admin"

        Write-Verbose "Target NDES administration endpoint: $($Target.AbsoluteUri)"

        # Seed a consistently shaped result object up front. Every code path fills in and emits this same

        # object so that a stream of results (e.g. multiple servers piped in) renders as one uniform table.

        # Disclosure fields default to $null and are populated only when the server actually leaks them.

        $Result = [ordered]@{

            Target                  = $Target.AbsoluteUri

            Status                  = $null

            'NetBIOS Computer Name' = $null

            'NetBIOS Domain Name'   = $null

            'DNS Computer Name'     = $null

            'DNS Domain Name'       = $null

            'DNS Forest Name'       = $null

            'OS Version'            = $null

        }

        # Build the curl arguments:

        #   -sSI : silent (no progress meter) but still show errors on stderr, headers only (HEAD-style response)

        #   -H   : send an unauthenticated NTLM type-1 (negotiate) message to trigger the server's type-2 challenge

        # The base64 blob is a standard, static NTLM type-1 negotiate message

        $CurlArgs = @('-sSI', '-H', 'Authorization: NTLM TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=', $Target.AbsoluteUri)

        If ($SkipCertificateCheck) {

            # Prepend -k so curl ignores TLS certificate validation errors (e.g. self-signed or untrusted certificates)

            Write-Verbose 'SkipCertificateCheck specified. TLS certificate validation will be bypassed (-k).'

            $CurlArgs = @('-k') + $CurlArgs

        }

        # Send the request. curl.exe is used rather than Invoke-WebRequest because the response headers,

        # including the raw NTLM challenge, need to be captured verbatim. stderr is redirected to a temp file so

        # curl's diagnostic (e.g. a TLS validation failure) can be captured separately from the response headers.

        Write-Verbose "Sending unauthenticated NTLM type-1 request to $($Target.AbsoluteUri)."

        $StdErrFile = [System.IO.Path]::GetTempFileName()

        Try {

            $Response = & curl.exe @CurlArgs 2>$StdErrFile

            $ExitCode = $LASTEXITCODE

            # Get-Content -Raw returns $null for an empty file (the normal case when curl succeeds). Guard against

            # that before trimming, because calling .Trim() on a null value throws

            $StdErr = Get-Content -Path $StdErrFile -Raw

            If ($StdErr) { $StdErr = $StdErr.Trim() } Else { $StdErr = '' }

        }

        Finally {

            Remove-Item -Path $StdErrFile -ErrorAction SilentlyContinue

        }

        # A non-zero curl exit code means the request never completed (e.g. TLS handshake aborted, host

        # unreachable). Without this check a failed connection is indistinguishable from a server that simply

        # did not offer NTLM, producing a false "Information not disclosed" result. Report it as inconclusive.

        If ($ExitCode -ne 0) {

            If ($ExitCode -eq 60) {

                # curl exit 60: the server's TLS certificate could not be validated (self-signed, name mismatch,

                # untrusted issuer). The request was never sent, so disclosure cannot be assessed. Re-run with

                # -SkipCertificateCheck to bypass certificate validation.

                Write-Warning "$($Target.AbsoluteUri) TLS certificate validation failed (curl exit 60). Re-run with -SkipCertificateCheck. Result inconclusive."

                $Result.Status = 'TLS certificate validation failed. Re-run with -SkipCertificateCheck. Result inconclusive.'

            }

            Else {

                Write-Warning "$($Target.AbsoluteUri) request failed (curl exit $ExitCode): $StdErr. Result inconclusive."

                $Result.Status = "Request failed (curl exit $ExitCode): $StdErr. Result inconclusive."

            }

            [PSCustomObject]$Result

            Continue

        }

        # Look for a WWW-Authenticate header that contains an NTLM type-2 payload (the base64 challenge)

        $Match = $Response | Select-String -Pattern '^WWW-Authenticate:\s*NTLM\s+(\S+)\s*$'

        If (-not $Match) {

            If ($Response | Select-String -Pattern '^WWW-Authenticate:\s*NTLM\s*$') {

                # The server advertised NTLM but did not return a type-2 payload on this attempt. This can happen

                # intermittently, so the result is inconclusive rather than a clean "not vulnerable"

                Write-Warning "$($Target.AbsoluteUri) offered an NTLM challenge but returned no type-2 payload. Repeat the test; this result is not conclusive."

                $Result.Status = 'NTLM challenge offered but no type-2 payload returned. Result inconclusive; repeat the test.'

            }

            Else {

                # No NTLM challenge at all, so there is nothing to disclose from this endpoint

                Write-Verbose "$($Target.AbsoluteUri) did not offer an NTLM challenge."

                $Result.Status = 'No NTLM challenge offered. Information not disclosed.'

            }

            [PSCustomObject]$Result

            Continue

        }

        # Decode the base64 challenge into the raw NTLM type-2 message bytes

        Write-Verbose 'NTLM type-2 challenge received. Decoding payload.'

        $Bytes = [Convert]::FromBase64String($Match.Matches.Groups[1].Value)

        # Validate the message: bytes 0-7 must be the 'NTLMSSP' signature and the message type at offset 8 must be 2 (challenge)

        If ([Text.Encoding]::ASCII.GetString($Bytes, 0, 7) -ne 'NTLMSSP' -or [BitConverter]::ToUInt32($Bytes, 8) -ne 2) {

            Write-Warning "$($Target.AbsoluteUri) response did not contain a valid NTLM type-2 message."

            $Result.Status = 'Response did not contain a valid NTLM type-2 message.'

            [PSCustomObject]$Result

            Continue

        }

        # TargetInfo field: length at offset 40, buffer offset at 44

        $InfoLength = [BitConverter]::ToUInt16($Bytes, 40)

        $InfoOffset = [BitConverter]::ToUInt32($Bytes, 44)

        Write-Verbose "TargetInfo block: length $InfoLength byte(s) at offset $InfoOffset."

        # Map of NTLM AV_PAIR types to human-readable labels for the fields worth surfacing

        $Labels = @{

            1 = 'NetBIOS Computer Name'

            2 = 'NetBIOS Domain Name'

            3 = 'DNS Computer Name'

            4 = 'DNS Domain Name'

            5 = 'DNS Forest Name'

        }

        # A valid type-2 challenge was returned, so the server is disclosing information

        $Result.Status = 'NTLM challenge returned. Information disclosed.'

        $Position = $InfoOffset

        # Walk the TargetInfo block, which is a sequence of AV_PAIR entries: 2-byte type, 2-byte length, then the value

        While ($Position -lt ($InfoOffset + $InfoLength)) {

            $Type = [BitConverter]::ToUInt16($Bytes, $Position)

            $Length = [BitConverter]::ToUInt16($Bytes, $Position + 2)

            If ($Type -eq 0) {

                # Type 0 (MsvAvEOL) marks the end of the AV_PAIR list

                Break

            }

            If ($Labels.ContainsKey([int]$Type)) {

                # Recognized field: decode the value (Unicode/UTF-16LE) and store it under its friendly label

                $Value = [Text.Encoding]::Unicode.GetString($Bytes, $Position + 4, $Length)

                Write-Verbose "Disclosed $($Labels[[int]$Type]): $Value"

                $Result[$Labels[[int]$Type]] = $Value

            }

            # Advance past this AV_PAIR (4-byte header + value) to the next entry

            $Position += 4 + $Length

        }

        # The OS version structure lives at offset 48: major (byte 48), minor (byte 49), build (uint16 at 50)

        $Result['OS Version'] = '{0}.{1}.{2}' -f $Bytes[48], $Bytes[49], [BitConverter]::ToUInt16($Bytes, 50)

        Write-Verbose "Disclosed OS Version: $($Result['OS Version'])"

        # Emit the collected disclosure fields as a single object

        [PSCustomObject]$Result

    }

}

# SIG # Begin signature block

# MIIk7AYJKoZIhvcNAQcCoIIk3TCCJNkCAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDyS0W3aN8PnOAp

# 0izgD5+CTRsjfX1YNV3rMpMP2vxYKKCCH6YwggWNMIIEdaADAgECAhAOmxiO+dAt

# 5+/bUOIIQBhaMA0GCSqGSIb3DQEBDAUAMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQK

# EwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNV

# BAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0yMjA4MDEwMDAwMDBa

# Fw0zMTExMDkyMzU5NTlaMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2Vy

# dCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lD

# ZXJ0IFRydXN0ZWQgUm9vdCBHNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC

# ggIBAL/mkHNo3rvkXUo8MCIwaTPswqclLskhPfKK2FnC4SmnPVirdprNrnsbhA3E

# MB/zG6Q4FutWxpdtHauyefLKEdLkX9YFPFIPUh/GnhWlfr6fqVcWWVVyr2iTcMKy

# unWZanMylNEQRBAu34LzB4TmdDttceItDBvuINXJIB1jKS3O7F5OyJP4IWGbNOsF

# xl7sWxq868nPzaw0QF+xembud8hIqGZXV59UWI4MK7dPpzDZVu7Ke13jrclPXuU1

# 5zHL2pNe3I6PgNq2kZhAkHnDeMe2scS1ahg4AxCN2NQ3pC4FfYj1gj4QkXCrVYJB

# MtfbBHMqbpEBfCFM1LyuGwN1XXhm2ToxRJozQL8I11pJpMLmqaBn3aQnvKFPObUR

# WBf3JFxGj2T3wWmIdph2PVldQnaHiZdpekjw4KISG2aadMreSx7nDmOu5tTvkpI6

# nj3cAORFJYm2mkQZK37AlLTSYW3rM9nF30sEAMx9HJXDj/chsrIRt7t/8tWMcCxB

# YKqxYxhElRp2Yn72gLD76GSmM9GJB+G9t+ZDpBi4pncB4Q+UDCEdslQpJYls5Q5S

# UUd0viastkF13nqsX40/ybzTQRESW+UQUOsxxcpyFiIJ33xMdT9j7CFfxCBRa2+x

# q4aLT8LWRV+dIPyhHsXAj6KxfgommfXkaS+YHS312amyHeUbAgMBAAGjggE6MIIB

# NjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTs1+OC0nFdZEzfLmc/57qYrhwP

# TzAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYunpyGd823IDzAOBgNVHQ8BAf8EBAMC

# AYYweQYIKwYBBQUHAQEEbTBrMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp

# Y2VydC5jb20wQwYIKwYBBQUHMAKGN2h0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNv

# bS9EaWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcnQwRQYDVR0fBD4wPDA6oDigNoY0

# aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEUm9vdENB

# LmNybDARBgNVHSAECjAIMAYGBFUdIAAwDQYJKoZIhvcNAQEMBQADggEBAHCgv0Nc

# Vec4X6CjdBs9thbX979XB72arKGHLOyFXqkauyL4hxppVCLtpIh3bb0aFPQTSnov

# Lbc47/T/gLn4offyct4kvFIDyE7QKt76LVbP+fT3rDB6mouyXtTP0UNEm0Mh65Zy

# oUi0mcudT6cGAxN3J0TU53/oWajwvy8LpunyNDzs9wPHh6jSTEAZNUZqaVSwuKFW

# juyk1T3osdz9HNj0d1pcVIxv76FQPfx2CWiEn2/K2yCNNWAcAgPLILCsWKAOQGPF

# mCLBsln1VWvPJ6tsds5vIy30fnFqI2si/xK4VC0nftg62fC2h5b9W9FcrBjDTZ9z

# twGpn1eqXijiuZQwggW0MIIDnKADAgECAhAOxitIKuZQm69NGxw+uiH/MA0GCSqG

# SIb3DQEBDAUAMGkxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5j

# LjFBMD8GA1UEAxM4RGlnaUNlcnQgVHJ1c3RlZCBHNCBDb2RlIFNpZ25pbmcgUlNB

# NDA5NiBTSEEzODQgMjAyMSBDQTEwHhcNMjYwNTE2MDAwMDAwWhcNMjcwODE3MjM1

# OTU5WjCBhjELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNV

# BAcTDU1pc3Npb24gVmllam8xJDAiBgNVBAoTG1JpY2hhcmQgTS4gSGlja3MgQ29u

# c3VsdGluZzEkMCIGA1UEAxMbUmljaGFyZCBNLiBIaWNrcyBDb25zdWx0aW5nMFkw

# EwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEOooTPiege6mCA4AriPO+Xh3mymiiZ+3k

# kn31uJifB2ojzzfY7VkAVKhgj+rcVBnofnj2b8OhvAJ4YaQ2Iwuc6aOCAgMwggH/

# MB8GA1UdIwQYMBaAFGg34Ou2O/hfEYb7/mF7CIhl9E5CMB0GA1UdDgQWBBQJvGhl

# Ahwi6UKROatrFKBmPLmd5TA+BgNVHSAENzA1MDMGBmeBDAEEATApMCcGCCsGAQUF

# BwIBFhtodHRwOi8vd3d3LmRpZ2ljZXJ0LmNvbS9DUFMwDgYDVR0PAQH/BAQDAgeA

# MBMGA1UdJQQMMAoGCCsGAQUFBwMDMIG1BgNVHR8Ega0wgaowU6BRoE+GTWh0dHA6

# Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5n

# UlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMFOgUaBPhk1odHRwOi8vY3JsNC5kaWdp

# Y2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEz

# ODQyMDIxQ0ExLmNybDCBlAYIKwYBBQUHAQEEgYcwgYQwJAYIKwYBBQUHMAGGGGh0

# dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBcBggrBgEFBQcwAoZQaHR0cDovL2NhY2Vy

# dHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0

# MDk2U0hBMzg0MjAyMUNBMS5jcnQwCQYDVR0TBAIwADANBgkqhkiG9w0BAQwFAAOC

# AgEAbaKnnRcJAMHjuWSc2PG/QhJ0jj4hQVwJIbddYDJNxPmD0cxuuorSiR9gX2nl

# ajqNI9N7Kl+FB3oheRTGh/wp4JgZMpCq0qS0zGJ/N6Js+HmVtbkFaPyYxJMXbIWq

# p9zKkoXtSXkpR6nGZnzYkn3EBcRlu4R6hIJHzM/C2PUztH/Hd4fGIryyD69iHvKx

# zotYdlHHY6+X1ACaQnuCz3TLxs3/CDKhPUXesKcISnXHmm4uCwyVdtGyl7wPuZVk

# +rfCIOeWn+XG5J7L8xwhXCPSJ5fKJ5m8/H5cICLR0I7hI4SUiybE1nG5CZ1hKhbW

# abSfNer1dHH/vSYi80YGXCej/88vZeCGQ9/rrjugsg0yN7WCPqNKjEMTYGWkrt37

# lp4cJqULS+alUbL6x1HBdoBStDE2CFmPivL7cCCtnudqCA6b3XB416/FlRo8t4Lw

# Dc2ty+RDKirWM84Zj3ANTVs5fi43rxClBQwngGdqi5TjriKHGTkEKYRIFTViy6Ie

# JDIboOkCFJU5vM7Curvh4rQnw+aM4CyjwnDwnzwcKQVZC3Iy1T4h/FvmpSgu5ouM

# wjdzaR3cSh4OPDRrfBl1YIOoZEOHcshCaHDC46t8+UyAf70BMlrB7Nj84ORTuKTi

# IlU062VzGeREc1KHJqp/S3/NtArpVUVQEgibRxQ99KJCOV8wggawMIIEmKADAgEC

# AhAIrUCyYNKcTJ9ezam9k67ZMA0GCSqGSIb3DQEBDAUAMGIxCzAJBgNVBAYTAlVT

# MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j

# b20xITAfBgNVBAMTGERpZ2lDZXJ0IFRydXN0ZWQgUm9vdCBHNDAeFw0yMTA0Mjkw

# MDAwMDBaFw0zNjA0MjgyMzU5NTlaMGkxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5E

# aWdpQ2VydCwgSW5jLjFBMD8GA1UEAxM4RGlnaUNlcnQgVHJ1c3RlZCBHNCBDb2Rl

# IFNpZ25pbmcgUlNBNDA5NiBTSEEzODQgMjAyMSBDQTEwggIiMA0GCSqGSIb3DQEB

# AQUAA4ICDwAwggIKAoICAQDVtC9C0CiteLdd1TlZG7GIQvUzjOs9gZdwxbvEhSYw

# n6SOaNhc9es0JAfhS0/TeEP0F9ce2vnS1WcaUk8OoVf8iJnBkcyBAz5NcCRks43i

# CH00fUyAVxJrQ5qZ8sU7H/Lvy0daE6ZMswEgJfMQ04uy+wjwiuCdCcBlp/qYgEk1

# hz1RGeiQIXhFLqGfLOEYwhrMxe6TSXBCMo/7xuoc82VokaJNTIIRSFJo3hC9FFdd

# 6BgTZcV/sk+FLEikVoQ11vkunKoAFdE3/hoGlMJ8yOobMubKwvSnowMOdKWvObar

# YBLj6Na59zHh3K3kGKDYwSNHR7OhD26jq22YBoMbt2pnLdK9RBqSEIGPsDsJ18eb

# MlrC/2pgVItJwZPt4bRc4G/rJvmM1bL5OBDm6s6R9b7T+2+TYTRcvJNFKIM2KmYo

# X7BzzosmJQayg9Rc9hUZTO1i4F4z8ujo7AqnsAMrkbI2eb73rQgedaZlzLvjSFDz

# d5Ea/ttQokbIYViY9XwCFjyDKK05huzUtw1T0PhH5nUwjewwk3YUpltLXXRhTT8S

# kXbev1jLchApQfDVxW0mdmgRQRNYmtwmKwH0iU1Z23jPgUo+QEdfyYFQc4UQIyFZ

# YIpkVMHMIRroOBl8ZhzNeDhFMJlP/2NPTLuqDQhTQXxYPUez+rbsjDIJAsxsPAxW

# EQIDAQABo4IBWTCCAVUwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUaDfg

# 67Y7+F8Rhvv+YXsIiGX0TkIwHwYDVR0jBBgwFoAU7NfjgtJxXWRM3y5nP+e6mK4c

# D08wDgYDVR0PAQH/BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMDMHcGCCsGAQUF

# BwEBBGswaTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEEG

# CCsGAQUFBzAChjVodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRU

# cnVzdGVkUm9vdEc0LmNydDBDBgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3JsMy5k

# aWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNybDAcBgNVHSAEFTAT

# MAcGBWeBDAEDMAgGBmeBDAEEATANBgkqhkiG9w0BAQwFAAOCAgEAOiNEPY0Idu6P

# vDqZ01bgAhql+Eg08yy25nRm95RysQDKr2wwJxMSnpBEn0v9nqN8JtU3vDpdSG2V

# 1T9J9Ce7FoFFUP2cvbaF4HZ+N3HLIvdaqpDP9ZNq4+sg0dVQeYiaiorBtr2hSBh+

# 3NiAGhEZGM1hmYFW9snjdufE5BtfQ/g+lP92OT2e1JnPSt0o618moZVYSNUa/tcn

# P/2Q0XaG3RywYFzzDaju4ImhvTnhOE7abrs2nfvlIVNaw8rpavGiPttDuDPITzgU

# kpn13c5UbdldAhQfQDN8A+KVssIhdXNSy0bYxDQcoqVLjc1vdjcshT8azibpGL6Q

# B7BDf5WIIIJw8MzK7/0pNVwfiThV9zeKiwmhywvpMRr/LhlcOXHhvpynCgbWJme3

# kuZOX956rEnPLqR0kq3bPKSchh/jwVYbKyP/j7XqiHtwa+aguv06P0WmxOgWkVKL

# QcBIhEuWTatEQOON8BUozu3xGFYHKi8QxAwIZDwzj64ojDzLj4gLDb879M4ee47v

# tevLt/B3E+bnKD+sEq6lLyJsQfmCXBVmzGwOysWGw/YmMwwHS6DTBwJqakAwSEs0

# qFEgu60bhQjiWQ1tygVQK+pKHJ6l/aCnHwZ05/LWUpD9r4VIIflXO7ScA+2GRfS0

# YW6/aOImYIbqyK+p/pQd52MbOoZWeE4wgga0MIIEnKADAgECAhANx6xXBf8hmS5A

# QyIMOkmGMA0GCSqGSIb3DQEBCwUAMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxE

# aWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMT

# GERpZ2lDZXJ0IFRydXN0ZWQgUm9vdCBHNDAeFw0yNTA1MDcwMDAwMDBaFw0zODAx

# MTQyMzU5NTlaMGkxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5j

# LjFBMD8GA1UEAxM4RGlnaUNlcnQgVHJ1c3RlZCBHNCBUaW1lU3RhbXBpbmcgUlNB

# NDA5NiBTSEEyNTYgMjAyNSBDQTEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK

# AoICAQC0eDHTCphBcr48RsAcrHXbo0ZodLRRF51NrY0NlLWZloMsVO1DahGPNRcy

# bEKq+RuwOnPhof6pvF4uGjwjqNjfEvUi6wuim5bap+0lgloM2zX4kftn5B1IpYzT

# qpyFQ/4Bt0mAxAHeHYNnQxqXmRinvuNgxVBdJkf77S2uPoCj7GH8BLuxBG5AvftB

# dsOECS1UkxBvMgEdgkFiDNYiOTx4OtiFcMSkqTtF2hfQz3zQSku2Ws3IfDReb6e3

# mmdglTcaarps0wjUjsZvkgFkriK9tUKJm/s80FiocSk1VYLZlDwFt+cVFBURJg6z

# MUjZa/zbCclF83bRVFLeGkuAhHiGPMvSGmhgaTzVyhYn4p0+8y9oHRaQT/aofEnS

# 5xLrfxnGpTXiUOeSLsJygoLPp66bkDX1ZlAeSpQl92QOMeRxykvq6gbylsXQskBB

# BnGy3tW/AMOMCZIVNSaz7BX8VtYGqLt9MmeOreGPRdtBx3yGOP+rx3rKWDEJlIqL

# XvJWnY0v5ydPpOjL6s36czwzsucuoKs7Yk/ehb//Wx+5kMqIMRvUBDx6z1ev+7ps

# NOdgJMoiwOrUG2ZdSoQbU2rMkpLiQ6bGRinZbI4OLu9BMIFm1UUl9VnePs6BaaeE

# WvjJSjNm2qA+sdFUeEY0qVjPKOWug/G6X5uAiynM7Bu2ayBjUwIDAQABo4IBXTCC

# AVkwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU729TSunkBnx6yuKQVvYv

# 1Ensy04wHwYDVR0jBBgwFoAU7NfjgtJxXWRM3y5nP+e6mK4cD08wDgYDVR0PAQH/

# BAQDAgGGMBMGA1UdJQQMMAoGCCsGAQUFBwMIMHcGCCsGAQUFBwEBBGswaTAkBggr

# BgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEEGCCsGAQUFBzAChjVo

# dHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0

# LmNydDBDBgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3JsMy5kaWdpY2VydC5jb20v

# RGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNybDAgBgNVHSAEGTAXMAgGBmeBDAEEAjAL

# BglghkgBhv1sBwEwDQYJKoZIhvcNAQELBQADggIBABfO+xaAHP4HPRF2cTC9vgvI

# tTSmf83Qh8WIGjB/T8ObXAZz8OjuhUxjaaFdleMM0lBryPTQM2qEJPe36zwbSI/m

# S83afsl3YTj+IQhQE7jU/kXjjytJgnn0hvrV6hqWGd3rLAUt6vJy9lMDPjTLxLgX

# f9r5nWMQwr8Myb9rEVKChHyfpzee5kH0F8HABBgr0UdqirZ7bowe9Vj2AIMD8liy

# rukZ2iA/wdG2th9y1IsA0QF8dTXqvcnTmpfeQh35k5zOCPmSNq1UH410ANVko43+

# Cdmu4y81hjajV/gxdEkMx1NKU4uHQcKfZxAvBAKqMVuqte69M9J6A47OvgRaPs+2

# ykgcGV00TYr2Lr3ty9qIijanrUR3anzEwlvzZiiyfTPjLbnFRsjsYg39OlV8cipD

# oq7+qNNjqFzeGxcytL5TTLL4ZaoBdqbhOhZ3ZRDUphPvSRmMThi0vw9vODRzW6Ax

# nJll38F0cuJG7uEBYTptMSbhdhGQDpOXgpIUsWTjd6xpR6oaQf/DJbg3s6KCLPAl

# Z66RzIg9sC+NJpud/v4+7RWsWCiKi9EOLLHfMR2ZyJ/+xhCx9yHbxtl5TPau1j/1

# MIDpMPx0LckTetiSuEtQvLsNz3Qbp7wGWqbIiOWCnb5WqxL3/BAPvIXKUjPSxyZs

# q8WhbaM2tszWkPZPubdcMIIG7TCCBNWgAwIBAgIQCoDvGEuN8QWC0cR2p5V0aDAN

# BgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQs

# IEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgVGltZVN0YW1waW5n

# IFJTQTQwOTYgU0hBMjU2IDIwMjUgQ0ExMB4XDTI1MDYwNDAwMDAwMFoXDTM2MDkw

# MzIzNTk1OVowYzELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMu

# MTswOQYDVQQDEzJEaWdpQ2VydCBTSEEyNTYgUlNBNDA5NiBUaW1lc3RhbXAgUmVz

# cG9uZGVyIDIwMjUgMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANBG

# rC0Sxp7Q6q5gVrMrV7pvUf+GcAoB38o3zBlCMGMyqJnfFNZx+wvA69HFTBdwbHwB

# SOeLpvPnZ8ZN+vo8dE2/pPvOx/Vj8TchTySA2R4QKpVD7dvNZh6wW2R6kSu9RJt/

# 4QhguSssp3qome7MrxVyfQO9sMx6ZAWjFDYOzDi8SOhPUWlLnh00Cll8pjrUcCV3

# K3E0zz09ldQ//nBZZREr4h/GI6Dxb2UoyrN0ijtUDVHRXdmncOOMA3CoB/iUSROU

# INDT98oksouTMYFOnHoRh6+86Ltc5zjPKHW5KqCvpSduSwhwUmotuQhcg9tw2YD3

# w6ySSSu+3qU8DD+nigNJFmt6LAHvH3KSuNLoZLc1Hf2JNMVL4Q1OpbybpMe46Yce

# NA0LfNsnqcnpJeItK/DhKbPxTTuGoX7wJNdoRORVbPR1VVnDuSeHVZlc4seAO+6d

# 2sC26/PQPdP51ho1zBp+xUIZkpSFA8vWdoUoHLWnqWU3dCCyFG1roSrgHjSHlq8x

# ymLnjCbSLZ49kPmk8iyyizNDIXj//cOgrY7rlRyTlaCCfw7aSUROwnu7zER6EaJ+

# AliL7ojTdS5PWPsWeupWs7NpChUk555K096V1hE0yZIXe+giAwW00aHzrDchIc2b

# Qhpp0IoKRR7YufAkprxMiXAJQ1XCmnCfgPf8+3mnAgMBAAGjggGVMIIBkTAMBgNV

# HRMBAf8EAjAAMB0GA1UdDgQWBBTkO/zyMe39/dfzkXFjGVBDz2GM6DAfBgNVHSME

# GDAWgBTvb1NK6eQGfHrK4pBW9i/USezLTjAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0l

# AQH/BAwwCgYIKwYBBQUHAwgwgZUGCCsGAQUFBwEBBIGIMIGFMCQGCCsGAQUFBzAB

# hhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wXQYIKwYBBQUHMAKGUWh0dHA6Ly9j

# YWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNFRpbWVTdGFtcGlu

# Z1JTQTQwOTZTSEEyNTYyMDI1Q0ExLmNydDBfBgNVHR8EWDBWMFSgUqBQhk5odHRw

# Oi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRUaW1lU3RhbXBp

# bmdSU0E0MDk2U0hBMjU2MjAyNUNBMS5jcmwwIAYDVR0gBBkwFzAIBgZngQwBBAIw

# CwYJYIZIAYb9bAcBMA0GCSqGSIb3DQEBCwUAA4ICAQBlKq3xHCcEua5gQezRCESe

# Y0ByIfjk9iJP2zWLpQq1b4URGnwWBdEZD9gBq9fNaNmFj6Eh8/YmRDfxT7C0k8FU

# FqNh+tshgb4O6Lgjg8K8elC4+oWCqnU/ML9lFfim8/9yJmZSe2F8AQ/UdKFOtj7Y

# MTmqPO9mzskgiC3QYIUP2S3HQvHG1FDu+WUqW4daIqToXFE/JQ/EABgfZXLWU0zi

# TN6R3ygQBHMUBaB5bdrPbF6MRYs03h4obEMnxYOX8VBRKe1uNnzQVTeLni2nHkX/

# QqvXnNb+YkDFkxUGtMTaiLR9wjxUxu2hECZpqyU1d0IbX6Wq8/gVutDojBIFeRlq

# AcuEVT0cKsb+zJNEsuEB7O7/cuvTQasnM9AWcIQfVjnzrvwiCZ85EE8LUkqRhoS3

# Y50OHgaY7T/lwd6UArb+BOVAkg2oOvol/DJgddJ35XTxfUlQ+8Hggt8l2Yv7roan

# cJIFcbojBcxlRcGG0LIhp6GvReQGgMgYxQbV1S3CrWqZzBt1R9xJgKf47CdxVRd/

# ndUlQ05oxYy2zRWVFjF7mcr4C34Mj3ocCVccAvlKV9jEnstrniLvUxxVZE/rptb7

# IRE2lskKPIJgbaP5t2nGj/ULLi49xTcBZU8atufk+EMF/cWuiC7POGT75qaL6vdC

# vHlshtjdNXOCIUjsarfNZzGCBJwwggSYAgEBMH0waTELMAkGA1UEBhMCVVMxFzAV

# BgNVBAoTDkRpZ2lDZXJ0LCBJbmMuMUEwPwYDVQQDEzhEaWdpQ2VydCBUcnVzdGVk

# IEc0IENvZGUgU2lnbmluZyBSU0E0MDk2IFNIQTM4NCAyMDIxIENBMQIQDsYrSCrm

# UJuvTRscProh/zANBglghkgBZQMEAgEFAKCBhDAYBgorBgEEAYI3AgEMMQowCKAC

# gAChAoAAMBkGCSqGSIb3DQEJAzEMBgorBgEEAYI3AgEEMBwGCisGAQQBgjcCAQsx

# DjAMBgorBgEEAYI3AgEVMC8GCSqGSIb3DQEJBDEiBCBHoqz6C9wZJD88QA3YJtbw

# 3Y+F/Dkvbiafrps/eSyMmjALBgcqhkjOPQIBBQAERzBFAiEAysY2cSzrqM//c/+f

# e1uRnXwsg7f50as8VOKiq+yYnRICICv0wbRgcklpTcvXkzOJRpKe5mB1uK+vF9vG

# xjcEUk3qoYIDJjCCAyIGCSqGSIb3DQEJBjGCAxMwggMPAgEBMH0waTELMAkGA1UE

# BhMCVVMxFzAVBgNVBAoTDkRpZ2lDZXJ0LCBJbmMuMUEwPwYDVQQDEzhEaWdpQ2Vy

# dCBUcnVzdGVkIEc0IFRpbWVTdGFtcGluZyBSU0E0MDk2IFNIQTI1NiAyMDI1IENB

# MQIQCoDvGEuN8QWC0cR2p5V0aDANBglghkgBZQMEAgEFAKBpMBgGCSqGSIb3DQEJ

# AzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTI2MDgxNjE2MzMyMlowLwYJ

# KoZIhvcNAQkEMSIEIEKXZErLyWBRTbUceN0shQ6HkR3nQjzhWY+c/eH3XT4IMA0G

# CSqGSIb3DQEBAQUABIICAF3k67njfB1vvKBj9Xy2EVS1KXSxYCtuxG6ZOklRYmfr

# 399G4zbVQT4fRwHL00OLdJWv/V8hpgxjRTMY/TRyGfEpay0U1cz37/CXFGcYylsQ

# C3tIQMKHLtkHvcSNmOB2IkhSRSy/BK4O7kxPsPzB5faGn/sUTYTMcFxTflL8Qqo9

# W/ogpckbg9iASNvc4WzlQ5nO7Wzx26gQLz2Kyh+2jBUjDjPgzUaJOvruYBv/TeTZ

# YBsSvIvy9q9ws+bHCV28f69IXqWrBs2miYKOelp8vxmLTWg6RZeXz/nZV3Lp0QXX

# PW8V+3s6dT2Mv/0fhBuM49sCJS+6+O8A8O6+chfOn6y5OHNpHNdxfwoJIe2kfe/u

# WdjEj8T2+Qw8w++AdmEHBXzgr0RQpAshf0J6WWRJbQrHeLN1h80CermSvYGForL1

# vaBSjLRfeqH9w+PivVDhkNNFrUoRF4LAXx5henuLgQNx/5BKmUFybjcHLyCXQbOC

# f5ZTngQrj3EYwyZrHbHjexNltS8ILSNe0Fq1TVmqL7MDM7qiCnkYiZjutMPd21WO

# 57z6cxPXB6pIYKlt9gyJmnWSv85CAtKaqzCUgwIFtVgKdHkkJ4hzZacjnxItAxk9

# motyXV/7kjq/dGNAs04O0vQD/kULnyXGBOiqbGbRMMEYclC2sdMyPLNoCEgZ/Rtb

# SIG # End signature block