Private/Get-StorageBlobReadLogs.ps1
|
function Convert-LogAnalyticsRows { param( [object]$Table ) $columns = @($Table.columns | ForEach-Object { [string]$_.name }) foreach ($row in @($Table.rows)) { $record = [ordered]@{} for ($index = 0; $index -lt $columns.Count; $index++) { $record[$columns[$index]] = $row[$index] } [pscustomobject]$record } } function Get-LogAnalyticsAccessToken { $token = Get-AzAccessToken -ResourceUrl "https://api.loganalytics.azure.com" -ErrorAction Stop if ($token.Token -is [securestring]) { return ([pscredential]::new("token", $token.Token)).GetNetworkCredential().Password } return [string]$token.Token } function Invoke-LogAnalyticsQuery { [CmdletBinding()] param( [Parameter(Mandatory = $true)] [string]$WorkspaceId, [Parameter(Mandatory = $true)] [string]$Query, [Parameter(Mandatory = $true)] [datetime]$StartTime, [Parameter(Mandatory = $true)] [datetime]$EndTime ) $accessToken = Get-LogAnalyticsAccessToken $headers = @{ Authorization = "Bearer $accessToken" "Content-Type" = "application/json" } $body = @{ query = $Query timespan = "$($StartTime.ToUniversalTime().ToString("o"))/$($EndTime.ToUniversalTime().ToString("o"))" } | ConvertTo-Json -Depth 10 $response = Invoke-RestRequestWithRetry ` -OperationName "Log Analytics query" ` -Request { Invoke-RestMethod ` -Method POST ` -Uri "https://api.loganalytics.azure.com/v1/workspaces/$WorkspaceId/query" ` -Headers $headers ` -Body $body ` -ErrorAction Stop } $primaryResult = @($response.tables | Where-Object name -eq "PrimaryResult" | Select-Object -First 1) if (-not $primaryResult) { return @() } return @(Convert-LogAnalyticsRows -Table $primaryResult) } function Get-AzureStorageAccountsForScope { param( [string]$Scope, [object[]]$Resources ) $scopeParts = Get-AzureScopeParts -Scope $Scope foreach ($resource in @($Resources)) { $resourceType = [string]$resource.ResourceType if (-not $resourceType.Equals("Microsoft.Storage/storageAccounts", [System.StringComparison]::OrdinalIgnoreCase)) { continue } $resourceId = [string]$resource.ResourceId if ([string]::IsNullOrWhiteSpace($resourceId)) { continue } if ($scopeParts.scopeType -eq "Subscription") { $resource continue } if ($scopeParts.scopeType -eq "ResourceGroup") { if ([string]$resource.ResourceGroupName -eq [string]$scopeParts.resourceGroup) { $resource } continue } if ($scopeParts.scopeType -eq "Resource" -and ( $resourceId.Equals([string]$Scope, [System.StringComparison]::OrdinalIgnoreCase) -or ([string]$Scope).StartsWith("$resourceId/", [System.StringComparison]::OrdinalIgnoreCase))) { $resource } } } function New-KqlStringLiteral { param([string]$Value) return "'$(([string]$Value).Replace("'", "''"))'" } function New-KqlDynamicStringArray { param([string[]]$Values) $items = @($Values | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Sort-Object -Unique | ForEach-Object { New-KqlStringLiteral -Value $_ }) return "dynamic([$($items -join ",")])" } function Get-StorageBlobAccessDirection { param([string]$OperationName) switch -Regex ([string]$OperationName) { "^(GetBlob|GetBlobProperties|GetBlobMetadata)$" { return "Read" } "^(PutBlob|PutBlock|PutBlockList|AppendBlock|CopyBlob|SetBlobMetadata|SetBlobProperties)$" { return "Publish" } default { return "Other" } } } function Get-StorageBlobParticipantType { param( [string]$RequesterAppId, [string]$RequesterUpn ) $hasApp = -not [string]::IsNullOrWhiteSpace($RequesterAppId) $hasUser = -not [string]::IsNullOrWhiteSpace($RequesterUpn) if ($hasApp -and $hasUser) { return "UserAndServicePrincipal" } if ($hasApp) { return "ServicePrincipal" } if ($hasUser) { return "User" } return "Unknown" } function ConvertTo-SafeStorageBlobUri { param([string]$Uri) if ([string]::IsNullOrWhiteSpace($Uri)) { return "" } try { $parsedUri = [System.Uri]::new($Uri) if ($parsedUri.IsAbsoluteUri) { return $parsedUri.GetLeftPart([System.UriPartial]::Path) } } catch { $queryStart = $Uri.IndexOf("?") if ($queryStart -ge 0) { return $Uri.Substring(0, $queryStart) } return $Uri } $relativeQueryStart = $Uri.IndexOf("?") if ($relativeQueryStart -ge 0) { return $Uri.Substring(0, $relativeQueryStart) } return $Uri } function Test-StorageBlobRequesterMatchesServicePrincipal { param( [object]$BlobAccess, [object]$ServicePrincipal ) $objectId = [string]$ServicePrincipal.objectId $appId = [string]$ServicePrincipal.appId $requesterObjectId = [string]$BlobAccess.requesterObjectId $requesterAppId = [string]$BlobAccess.requesterAppId if ($objectId -and $requesterObjectId -and $requesterObjectId.Equals($objectId, [System.StringComparison]::OrdinalIgnoreCase)) { return $true } if ($appId -and $requesterAppId -and $requesterAppId.Equals($appId, [System.StringComparison]::OrdinalIgnoreCase)) { return $true } return $false } function Get-StorageBlobReadLogs { [CmdletBinding()] param( [Parameter(Mandatory = $true)] [string]$WorkspaceId, [Parameter(Mandatory = $true)] [object[]]$StorageAccounts, [object]$ServicePrincipal = $null, [Parameter(Mandatory = $true)] [datetime]$StartTime, [ValidateRange(1, 1000000)] [int]$MaxRecord = 5000, [string[]]$BlobReadOperationNames = @("GetBlob", "PutBlob", "PutBlock", "PutBlockList", "AppendBlock", "CopyBlob") ) $accounts = @($StorageAccounts | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_.Name) } | Sort-Object Name -Unique) if ($accounts.Count -eq 0) { return @() } $accountNames = @($accounts | ForEach-Object { [string]$_.Name }) $accountResourceIds = @($accounts | ForEach-Object { [string]$_.ResourceId }) $query = @" let targetAccounts = $(New-KqlDynamicStringArray -Values $accountNames); let targetResourceIds = $(New-KqlDynamicStringArray -Values $accountResourceIds); let readOperations = $(New-KqlDynamicStringArray -Values $BlobReadOperationNames); let blobAccessEvents = StorageBlobLogs | where AccountName in~ (targetAccounts) or _ResourceId in~ (targetResourceIds) | where OperationName in~ (readOperations) | extend RequesterObjectId = tostring(column_ifexists("RequesterObjectId", "")), RequesterAppId = tostring(column_ifexists("RequesterAppId", "")), RequesterTenantId = tostring(column_ifexists("RequesterTenantId", "")), RequesterUpn = tostring(column_ifexists("RequesterUpn", "")), UserAgentHeader = tostring(column_ifexists("UserAgentHeader", "")), AuthenticationHash = tostring(column_ifexists("AuthenticationHash", "")), SasExpiryStatus = tostring(column_ifexists("SasExpiryStatus", "")), SasGeneratorObjectId = tostring(extract(@"(?i)(?:[?&]skoid=)([^&]+)", 1, Uri)), SasGeneratorTenantId = tostring(extract(@"(?i)(?:[?&]sktid=)([^&]+)", 1, Uri)), SasExpiresOn = tostring(extract(@"(?i)(?:[?&](?:ske|se)=)([^&]+)", 1, Uri)), SasSignedIdentifier = tostring(extract(@"(?i)(?:[?&]si=)([^&]+)", 1, Uri)), SasSignedPermissions = tostring(extract(@"(?i)(?:[?&]sp=)([^&]+)", 1, Uri)), SafeUri = tostring(split(Uri, "?")[0]); let sasGeneratorEvents = StorageBlobLogs | where AccountName in~ (targetAccounts) or _ResourceId in~ (targetResourceIds) | where OperationName =~ "GetUserDelegationKey" | extend SasGeneratorEventTimestamp = TimeGenerated, DelegationGeneratorObjectId = tostring(column_ifexists("RequesterObjectId", "")), DelegationGeneratorAppId = tostring(column_ifexists("RequesterAppId", "")), DelegationGeneratorTenantId = tostring(column_ifexists("RequesterTenantId", "")), DelegationGeneratorUpn = tostring(column_ifexists("RequesterUpn", "")) | where isnotempty(DelegationGeneratorObjectId) | summarize arg_max(SasGeneratorEventTimestamp, DelegationGeneratorAppId, DelegationGeneratorTenantId, DelegationGeneratorUpn) by AccountName, DelegationGeneratorObjectId; blobAccessEvents | join kind=leftouter sasGeneratorEvents on $left.AccountName == $right.AccountName and $left.SasGeneratorObjectId == $right.DelegationGeneratorObjectId | extend SasGeneratorAppId = DelegationGeneratorAppId, SasGeneratorTenantId = iff(isempty(SasGeneratorTenantId), DelegationGeneratorTenantId, SasGeneratorTenantId), SasGeneratorUpn = DelegationGeneratorUpn | project TimeGenerated, AccountName, OperationName, StatusCode, StatusText, AuthenticationType, AuthenticationHash, SasExpiryStatus, SasGeneratorObjectId, SasGeneratorTenantId, SasGeneratorUpn, SasGeneratorAppId, SasGeneratorEventTimestamp, SasExpiresOn, SasSignedIdentifier, SasSignedPermissions, RequesterObjectId, RequesterAppId, RequesterTenantId, RequesterUpn, CallerIpAddress, UserAgentHeader, SafeUri, ObjectKey, _ResourceId | order by TimeGenerated desc | take $MaxRecord "@ $rows = @(Invoke-LogAnalyticsQuery ` -WorkspaceId $WorkspaceId ` -Query $query ` -StartTime $StartTime ` -EndTime (Get-Date)) foreach ($row in $rows) { $safeUri = if (-not [string]::IsNullOrWhiteSpace([string]$row.SafeUri)) { [string]$row.SafeUri } else { ConvertTo-SafeStorageBlobUri -Uri ([string]$row.Uri) } [pscustomobject]@{ eventTimestamp = [string]$row.TimeGenerated storageAccountName = [string]$row.AccountName storageAccountResourceId = [string]$row._ResourceId operationName = [string]$row.OperationName statusCode = [string]$row.StatusCode statusText = [string]$row.StatusText accessDirection = Get-StorageBlobAccessDirection -OperationName ([string]$row.OperationName) authenticationType = [string]$row.AuthenticationType authenticationHash = [string]$row.AuthenticationHash sasExpiryStatus = [string]$row.SasExpiryStatus sasGeneratorObjectId = [string]$row.SasGeneratorObjectId sasGeneratorAppId = [string]$row.SasGeneratorAppId sasGeneratorTenantId = [string]$row.SasGeneratorTenantId sasGeneratorUpn = [string]$row.SasGeneratorUpn sasGeneratorEventTimestamp = [string]$row.SasGeneratorEventTimestamp sasExpiresOn = [string]$row.SasExpiresOn sasSignedIdentifier = [string]$row.SasSignedIdentifier sasSignedPermissions = [string]$row.SasSignedPermissions requesterObjectId = [string]$row.RequesterObjectId requesterAppId = [string]$row.RequesterAppId requesterTenantId = [string]$row.RequesterTenantId requesterUpn = [string]$row.RequesterUpn requesterType = Get-StorageBlobParticipantType -RequesterAppId ([string]$row.RequesterAppId) -RequesterUpn ([string]$row.RequesterUpn) callerIpAddress = [string]$row.CallerIpAddress userAgentHeader = [string]$row.UserAgentHeader uri = ConvertTo-SafeStorageBlobUri -Uri $safeUri objectKey = [string]$row.ObjectKey matchesInspectedServicePrincipal = if ($ServicePrincipal) { [bool](Test-StorageBlobRequesterMatchesServicePrincipal -BlobAccess ([pscustomobject]@{ requesterObjectId = [string]$row.RequesterObjectId requesterAppId = [string]$row.RequesterAppId }) -ServicePrincipal $ServicePrincipal) } else { $false } evidenceConfidence = "medium" evidenceReason = "StorageBlobLogs show a blob data-plane operation recorded by Azure Storage diagnostic logs. Publish operations can represent data sent to an agent; read operations can represent data consumed from it." } } } function Get-StorageBlobReadCallers { param( [object[]]$BlobReadEvidence ) $groups = @($BlobReadEvidence) | Group-Object -Property { Get-OwnerLensPrincipalKey ` -ObjectId ([string]$_.requesterObjectId) ` -AppId ([string]$_.requesterAppId) ` -Upn ([string]$_.requesterUpn) } foreach ($group in $groups) { $items = @($group.Group | Sort-Object eventTimestamp) $first = $items | Select-Object -First 1 $last = $items | Select-Object -Last 1 $publishCount = @($items | Where-Object accessDirection -eq "Publish").Count $readCount = @($items | Where-Object accessDirection -eq "Read").Count [pscustomobject]@{ requesterKey = [string]$group.Name requesterObjectId = [string]$last.requesterObjectId requesterAppId = [string]$last.requesterAppId requesterTenantId = [string]$last.requesterTenantId requesterUpn = [string]$last.requesterUpn requesterType = [string]$last.requesterType authenticationType = [string]$last.authenticationType readCount = [int]$items.Count blobAccessCount = [int]$items.Count blobReadCount = [int]$readCount blobPublishCount = [int]$publishCount firstSeen = [string]$first.eventTimestamp lastSeen = [string]$last.eventTimestamp storageAccounts = @($items | Select-Object -ExpandProperty storageAccountName -Unique | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }) accessDirections = @($items | Select-Object -ExpandProperty accessDirection -Unique | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }) operationNames = @($items | Select-Object -ExpandProperty operationName -Unique | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }) callerIpAddresses = @($items | Select-Object -ExpandProperty callerIpAddress -Unique | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }) userAgentHeaders = @($items | Select-Object -ExpandProperty userAgentHeader -Unique | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Select-Object -First 10) sasAuthenticationCount = [int](@($items | Where-Object { ([string]$_.authenticationType).Equals("SAS", [System.StringComparison]::OrdinalIgnoreCase) }).Count) sasGeneratorObjectIds = @($items | ForEach-Object { [string]$_.sasGeneratorObjectId } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Sort-Object -Unique) sasGeneratorAppIds = @($items | ForEach-Object { [string]$_.sasGeneratorAppId } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Sort-Object -Unique) sasGeneratorUpns = @($items | ForEach-Object { [string]$_.sasGeneratorUpn } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Sort-Object -Unique) sasSignedIdentifiers = @($items | ForEach-Object { [string]$_.sasSignedIdentifier } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Sort-Object -Unique) sampleUris = @($items | Select-Object -ExpandProperty uri -Unique | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Select-Object -First 10) matchesInspectedServicePrincipal = [bool](@($items | Where-Object matchesInspectedServicePrincipal).Count -gt 0) evidenceConfidence = "medium" evidenceReason = "Requester has one or more StorageBlobLogs data-plane records in the selected time window, grouped with both user and service principal identifiers when Azure logged both." } } } function Get-StorageBlobReadObjects { param( [object[]]$BlobReadEvidence ) $readEvidence = @($BlobReadEvidence | Where-Object { ([string]$_.accessDirection).Equals("Read", [System.StringComparison]::OrdinalIgnoreCase) }) $groups = @($readEvidence) | Group-Object -Property { $uri = [string]$_.uri $objectKey = [string]$_.objectKey $requesterKey = Get-OwnerLensPrincipalKey ` -ObjectId ([string]$_.requesterObjectId) ` -AppId ([string]$_.requesterAppId) ` -Upn ([string]$_.requesterUpn) $blobKey = if (-not [string]::IsNullOrWhiteSpace($uri)) { "uri:$uri" } elseif (-not [string]::IsNullOrWhiteSpace($objectKey)) { "objectKey:$objectKey" } else { "unknownBlob" } return "$requesterKey|$blobKey" } foreach ($group in $groups) { $items = @($group.Group | Sort-Object eventTimestamp) $first = $items | Select-Object -First 1 $last = $items | Select-Object -Last 1 [pscustomobject]@{ requesterBlobKey = [string]$group.Name requesterObjectId = [string]$last.requesterObjectId requesterAppId = [string]$last.requesterAppId requesterTenantId = [string]$last.requesterTenantId requesterUpn = [string]$last.requesterUpn requesterType = [string]$last.requesterType authenticationType = [string]$last.authenticationType storageAccountName = [string]$last.storageAccountName storageAccountResourceId = [string]$last.storageAccountResourceId uri = [string]$last.uri objectKey = [string]$last.objectKey sasAuthenticationCount = [int](@($items | Where-Object { ([string]$_.authenticationType).Equals("SAS", [System.StringComparison]::OrdinalIgnoreCase) }).Count) sasGeneratorObjectIds = @($items | ForEach-Object { [string]$_.sasGeneratorObjectId } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Sort-Object -Unique) sasGeneratorAppIds = @($items | ForEach-Object { [string]$_.sasGeneratorAppId } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Sort-Object -Unique) sasGeneratorUpns = @($items | ForEach-Object { [string]$_.sasGeneratorUpn } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Sort-Object -Unique) sasSignedIdentifiers = @($items | ForEach-Object { [string]$_.sasSignedIdentifier } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Sort-Object -Unique) blobReadCount = [int]$items.Count firstReadAt = [string]$first.eventTimestamp lastReadAt = [string]$last.eventTimestamp operationNames = @($items | Select-Object -ExpandProperty operationName -Unique | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }) callerIpAddresses = @($items | Select-Object -ExpandProperty callerIpAddress -Unique | Where-Object { -not [string]::IsNullOrWhiteSpace($_) }) userAgentHeaders = @($items | Select-Object -ExpandProperty userAgentHeader -Unique | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Select-Object -First 10) matchesInspectedServicePrincipal = [bool](@($items | Where-Object matchesInspectedServicePrincipal).Count -gt 0) evidenceConfidence = "medium" evidenceReason = "Requester read a specific blob one or more times according to StorageBlobLogs in the selected time window." } } } # SIG # Begin signature block # MII9NAYJKoZIhvcNAQcCoII9JTCCPSECAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCT8GPolyGJzcp+ # boWqMYoDgzCZyIaIns90tYwg7w4ll6CCIfYwggXMMIIDtKADAgECAhBUmNLR1FsZ # lUgTecgRwIeZMA0GCSqGSIb3DQEBDAUAMHcxCzAJBgNVBAYTAlVTMR4wHAYDVQQK # ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xSDBGBgNVBAMTP01pY3Jvc29mdCBJZGVu # dGl0eSBWZXJpZmljYXRpb24gUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgMjAy # MDAeFw0yMDA0MTYxODM2MTZaFw00NTA0MTYxODQ0NDBaMHcxCzAJBgNVBAYTAlVT # MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xSDBGBgNVBAMTP01pY3Jv # c29mdCBJZGVudGl0eSBWZXJpZmljYXRpb24gUm9vdCBDZXJ0aWZpY2F0ZSBBdXRo # b3JpdHkgMjAyMDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALORKgeD # Bmf9np3gx8C3pOZCBH8Ppttf+9Va10Wg+3cL8IDzpm1aTXlT2KCGhFdFIMeiVPvH # or+Kx24186IVxC9O40qFlkkN/76Z2BT2vCcH7kKbK/ULkgbk/WkTZaiRcvKYhOuD # PQ7k13ESSCHLDe32R0m3m/nJxxe2hE//uKya13NnSYXjhr03QNAlhtTetcJtYmrV # qXi8LW9J+eVsFBT9FMfTZRY33stuvF4pjf1imxUs1gXmuYkyM6Nix9fWUmcIxC70 # ViueC4fM7Ke0pqrrBc0ZV6U6CwQnHJFnni1iLS8evtrAIMsEGcoz+4m+mOJyoHI1 # vnnhnINv5G0Xb5DzPQCGdTiO0OBJmrvb0/gwytVXiGhNctO/bX9x2P29Da6SZEi3 # W295JrXNm5UhhNHvDzI9e1eM80UHTHzgXhgONXaLbZ7LNnSrBfjgc10yVpRnlyUK # xjU9lJfnwUSLgP3B+PR0GeUw9gb7IVc+BhyLaxWGJ0l7gpPKWeh1R+g/OPTHU3mg # trTiXFHvvV84wRPmeAyVWi7FQFkozA8kwOy6CXcjmTimthzax7ogttc32H83rwjj # O3HbbnMbfZlysOSGM1l0tRYAe1BtxoYT2v3EOYI9JACaYNq6lMAFUSw0rFCZE4e7 # swWAsk0wAly4JoNdtGNz764jlU9gKL431VulAgMBAAGjVDBSMA4GA1UdDwEB/wQE # AwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTIftJqhSobyhmYBAcnz1AQ # T2ioojAQBgkrBgEEAYI3FQEEAwIBADANBgkqhkiG9w0BAQwFAAOCAgEAr2rd5hnn # LZRDGU7L6VCVZKUDkQKL4jaAOxWiUsIWGbZqWl10QzD0m/9gdAmxIR6QFm3FJI9c # Zohj9E/MffISTEAQiwGf2qnIrvKVG8+dBetJPnSgaFvlVixlHIJ+U9pW2UYXeZJF # xBA2CFIpF8svpvJ+1Gkkih6PsHMNzBxKq7Kq7aeRYwFkIqgyuH4yKLNncy2RtNwx # AQv3Rwqm8ddK7VZgxCwIo3tAsLx0J1KH1r6I3TeKiW5niB31yV2g/rarOoDXGpc8 # FzYiQR6sTdWD5jw4vU8w6VSp07YEwzJ2YbuwGMUrGLPAgNW3lbBeUU0i/OxYqujY # lLSlLu2S3ucYfCFX3VVj979tzR/SpncocMfiWzpbCNJbTsgAlrPhgzavhgplXHT2 # 6ux6anSg8Evu75SjrFDyh+3XOjCDyft9V77l4/hByuVkrrOj7FjshZrM77nq81YY # uVxzmq/FdxeDWds3GhhyVKVB0rYjdaNDmuV3fJZ5t0GNv+zcgKCf0Xd1WF81E+Al # GmcLfc4l+gcK5GEh2NQc5QfGNpn0ltDGFf5Ozdeui53bFv0ExpK91IjmqaOqu/dk # ODtfzAzQNb50GQOmxapMomE2gj4d8yu8l13bS3g7LfU772Aj6PXsCyM2la+YZr9T # 03u4aUoqlmZpxJTG9F9urJh4iIAGXKKy7aIwggaoMIIEkKADAgECAhMzAATfN8Fd # CkCAOd/lAAAABN83MA0GCSqGSIb3DQEBDAUAMFoxCzAJBgNVBAYTAlVTMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKzApBgNVBAMTIk1pY3Jvc29mdCBJ # RCBWZXJpZmllZCBDUyBFT0MgQ0EgMDQwHhcNMjYwODI0MDgwNzU1WhcNMjYwODI3 # MDgwNzU1WjBpMQswCQYDVQQGEwJQTDEXMBUGA1UECB4OAUEA8wBkAHoAawBpAGUx # DzANBgNVBAcTBldpZWx1bjEXMBUGA1UEChMOc29mdDRwbSBzcCB6b28xFzAVBgNV # BAMTDnNvZnQ0cG0gc3Agem9vMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKC # AYEAsUB/A4IgTtKleM7nBJSDDNsBT3BEKv/mr4dnsVBvBZkNkBifW3Ofxb4609Vg # fPIXAJpmhke5LoS085d62kfncFq3L5lyEk+UZyKlU0XGOToUkyIwXJ9ZMRcZzHUq # VuzSEgf2niOdtZLGbAJA3j27caB15YiJXNXmcdpFtNOTdpFkNnlVnBq+IzAWHD43 # XXp/E/NuEP+yQbtANzSHY0QOeOaSQEzPIm/JGmbXtYSrStuGTKJg6WM5VIESIhZe # jfpiuTgde/pKVy7tPktOoqzyhALoiplucnn32fGJxHWYX3AvApukJViJobPPHUrh # mQOIK5Vvcq0ED3eNR2L3oOTzJdZcM6K1LhEadLpniex5z6xi4ff7NTisGdyJa3RA # 0xxCxwXjreDHnFsEPExMdQjX625GOj9M5KbbxaPGWnRps4cLrU2gtqH8wcF3PxSE # gab5oKyXlwE5ymXwh0OeIqgH4ahmVts+Q6EnSzUOhh/Y33Q0voBDrJH4iSzKZiAO # MMcbAgMBAAGjggHWMIIB0jAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIHgDA9 # BgNVHSUENjA0BgorBgEEAYI3YQEABggrBgEFBQcDAwYcKwYBBAGCN2GCycz3dYGA # 0Y0Tg469piSB0sq0aDAdBgNVHQ4EFgQUad/TRiMm/CKCInTGHVoP2MIOwzAwHwYD # VR0jBBgwFoAUmvFUd3UMhxY3RqCs3nn59H/BeOkwZwYDVR0fBGAwXjBcoFqgWIZW # aHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0JTIw # SUQlMjBWZXJpZmllZCUyMENTJTIwRU9DJTIwQ0ElMjAwNC5jcmwwdAYIKwYBBQUH # AQEEaDBmMGQGCCsGAQUFBzAChlhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtp # b3BzL2NlcnRzL01pY3Jvc29mdCUyMElEJTIwVmVyaWZpZWQlMjBDUyUyMEVPQyUy # MENBJTIwMDQuY3J0MFQGA1UdIARNMEswSQYEVR0gADBBMD8GCCsGAQUFBwIBFjNo # dHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL0RvY3MvUmVwb3NpdG9yeS5o # dG0wDQYJKoZIhvcNAQEMBQADggIBAF8p+KjsdCBVGNRuYw0+ZJbOhVz3n1vXUnbE # CHXjQOq8+j4p2dvA+5NdPKwbSiIcnwzQ26B1TOLqIT5lIwlsoFnXpopgIduf5Tc5 # P49mv+hNL2F1Wg3yJPPo59SMvUa08uX3k2KItoOiUpmpo1/BoPfasb6MJgTu235m # Z3MHCp1gXSqTgNSIyJR0U1Lf1+6IGlvmOHyRHFAz3y1ttrQe/BUGEF6WHFXsEbkU # KVhnYTk+e/G6wpiEHcGyYyZ+HW67jM9Eb9J7EeHt/NptwoHAL9tAEfP0xDlbWgMe # 6U9DyBeYqeGSCqoUHi2MD77y1g2yoG44SnzQCWHmrQVViBcdVyjU2TpmVI/9+hhk # X6wnlaSd8qU2ha/cmUmKevNr9wspd1H0yYeBwj+3oMSol8rcsa5p0w3rb1iHmzG/ # aSrA/E+ghWy4wXGayJ3jdpxjO+mCk6Qd7jEmUsh+pRd6w0zbE7CgznlYyLV5qfPa # eCtD1yXjpQIpa3E7srlMhZd8MFcLCmdKajZNMO83tTXMqnhOEnxxB6dHJ+diDdrG # 3egnxVUSLJRezkNLBzYwpw3FvJa7E7WpM/lSzi7MGp/Nr+KIsGwQ3M04gJIc6pU1 # n8wj85D9ACJnWKwkiPl647BeI94Ttu5SUXi+G+9588W8rlTvSyq0df0GeGdrsuZT # Y/mNoLE+MIIGqDCCBJCgAwIBAgITMwAE3zfBXQpAgDnf5QAAAATfNzANBgkqhkiG # 9w0BAQwFADBaMQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv # cmF0aW9uMSswKQYDVQQDEyJNaWNyb3NvZnQgSUQgVmVyaWZpZWQgQ1MgRU9DIENB # IDA0MB4XDTI2MDgyNDA4MDc1NVoXDTI2MDgyNzA4MDc1NVowaTELMAkGA1UEBhMC # UEwxFzAVBgNVBAgeDgFBAPMAZAB6AGsAaQBlMQ8wDQYDVQQHEwZXaWVsdW4xFzAV # BgNVBAoTDnNvZnQ0cG0gc3Agem9vMRcwFQYDVQQDEw5zb2Z0NHBtIHNwIHpvbzCC # AaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBALFAfwOCIE7SpXjO5wSUgwzb # AU9wRCr/5q+HZ7FQbwWZDZAYn1tzn8W+OtPVYHzyFwCaZoZHuS6EtPOXetpH53Ba # ty+ZchJPlGcipVNFxjk6FJMiMFyfWTEXGcx1Klbs0hIH9p4jnbWSxmwCQN49u3Gg # deWIiVzV5nHaRbTTk3aRZDZ5VZwaviMwFhw+N116fxPzbhD/skG7QDc0h2NEDnjm # kkBMzyJvyRpm17WEq0rbhkyiYOljOVSBEiIWXo36Yrk4HXv6Slcu7T5LTqKs8oQC # 6IqZbnJ599nxicR1mF9wLwKbpCVYiaGzzx1K4ZkDiCuVb3KtBA93jUdi96Dk8yXW # XDOitS4RGnS6Z4nsec+sYuH3+zU4rBnciWt0QNMcQscF463gx5xbBDxMTHUI1+tu # Rjo/TOSm28Wjxlp0abOHC61NoLah/MHBdz8UhIGm+aCsl5cBOcpl8IdDniKoB+Go # ZlbbPkOhJ0s1DoYf2N90NL6AQ6yR+IksymYgDjDHGwIDAQABo4IB1jCCAdIwDAYD # VR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwPQYDVR0lBDYwNAYKKwYBBAGCN2EB # AAYIKwYBBQUHAwMGHCsGAQQBgjdhgsnM93WBgNGNE4OOvaYkgdLKtGgwHQYDVR0O # BBYEFGnf00YjJvwigiJ0xh1aD9jCDsMwMB8GA1UdIwQYMBaAFJrxVHd1DIcWN0ag # rN55+fR/wXjpMGcGA1UdHwRgMF4wXKBaoFiGVmh0dHA6Ly93d3cubWljcm9zb2Z0 # LmNvbS9wa2lvcHMvY3JsL01pY3Jvc29mdCUyMElEJTIwVmVyaWZpZWQlMjBDUyUy # MEVPQyUyMENBJTIwMDQuY3JsMHQGCCsGAQUFBwEBBGgwZjBkBggrBgEFBQcwAoZY # aHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jZXJ0cy9NaWNyb3NvZnQl # MjBJRCUyMFZlcmlmaWVkJTIwQ1MlMjBFT0MlMjBDQSUyMDA0LmNydDBUBgNVHSAE # TTBLMEkGBFUdIAAwQTA/BggrBgEFBQcCARYzaHR0cDovL3d3dy5taWNyb3NvZnQu # Y29tL3BraW9wcy9Eb2NzL1JlcG9zaXRvcnkuaHRtMA0GCSqGSIb3DQEBDAUAA4IC # AQBfKfio7HQgVRjUbmMNPmSWzoVc959b11J2xAh140DqvPo+KdnbwPuTXTysG0oi # HJ8M0NugdUzi6iE+ZSMJbKBZ16aKYCHbn+U3OT+PZr/oTS9hdVoN8iTz6OfUjL1G # tPLl95NiiLaDolKZqaNfwaD32rG+jCYE7tt+ZmdzBwqdYF0qk4DUiMiUdFNS39fu # iBpb5jh8kRxQM98tbba0HvwVBhBelhxV7BG5FClYZ2E5PnvxusKYhB3BsmMmfh1u # u4zPRG/SexHh7fzabcKBwC/bQBHz9MQ5W1oDHulPQ8gXmKnhkgqqFB4tjA++8tYN # sqBuOEp80Alh5q0FVYgXHVco1Nk6ZlSP/foYZF+sJ5WknfKlNoWv3JlJinrza/cL # KXdR9MmHgcI/t6DEqJfK3LGuadMN629Yh5sxv2kqwPxPoIVsuMFxmsid43acYzvp # gpOkHe4xJlLIfqUXesNM2xOwoM55WMi1eanz2ngrQ9cl46UCKWtxO7K5TIWXfDBX # CwpnSmo2TTDvN7U1zKp4ThJ8cQenRyfnYg3axt3oJ8VVEiyUXs5DSwc2MKcNxbyW # uxO1qTP5Us4uzBqfza/iiLBsENzNOICSHOqVNZ/MI/OQ/QAiZ1isJIj5euOwXiPe # E7buUlF4vhvvefPFvK5U70sqtHX9Bnhna7LmU2P5jaCxPjCCBygwggUQoAMCAQIC # EzMAAAAXJ0UJC4uHr8YAAAAAABcwDQYJKoZIhvcNAQEMBQAwYzELMAkGA1UEBhMC # VVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjE0MDIGA1UEAxMrTWlj # cm9zb2Z0IElEIFZlcmlmaWVkIENvZGUgU2lnbmluZyBQQ0EgMjAyMTAeFw0yNjAz # MjYxODExMzFaFw0zMTAzMjYxODExMzFaMFoxCzAJBgNVBAYTAlVTMR4wHAYDVQQK # ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKzApBgNVBAMTIk1pY3Jvc29mdCBJRCBW # ZXJpZmllZCBDUyBFT0MgQ0EgMDQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK # AoICAQCCx2T+Aw9mKgGVzJ+Tq0PMn49G3itIsYpbx7ClLSRHFe1RELdPcZ1sIqWO # hsSfy6yyqEapClGH9Je9FXA1cQgZvvpQbkg+QInVLr/0EPrVBCwrM96lbRI2PxNe # CwXG9LsyW2hG6KQgintDmNCBo4zpDIr377plVdSliZm6UB7rHwmvBnR02QT6tnrq # Wq2ihzB6lRJVTEzuh0OafzIMeMnYM0+x+ve5EOLHdfiq+HXiMf9Jb7YLHtYgyHIi # JA7bTWLqFSLGaTh7ZlbxbsLXA91OOroEpv7OjzFuu3tkpC9FflA4Dp2Euq4+qPmx # UqfGp+TX0gLRJp9NJOzzILjcTD3rkFFFbxUv1xyg6avivFDLtoKBhM2Td138umE1 # pNOacanuSYtPHIeQHmB6haFi64avLBLwTTAm/Rbit860cFXR72wq+5Qh4hSmezHq # KXERWPpVBe+APrJ4Iqc+aPeMmIkoCWZQO22HnLNFUFSXjiwyIbgvlH/LIAJEqTaf # TzxDZgKhlLU7zr6gwsq3WNpcYQI6NuxWnwh3VVDDyF7onQqKs5Ll7bleVN0Y8Vvq # gE45ppyBbvwqN/Run5fMCCRz3aYMY0kZhKO92eP7t4zHqZ5bQMAgZ0tE2Pz/jb0w # iykUF/PcoOqqk3vVLiRDYst6vd3GEMNzMpUUvQcvBG46+COIbwIDAQABo4IB3DCC # AdgwDgYDVR0PAQH/BAQDAgGGMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBSa # 8VR3dQyHFjdGoKzeefn0f8F46TBUBgNVHSAETTBLMEkGBFUdIAAwQTA/BggrBgEF # BQcCARYzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9Eb2NzL1JlcG9z # aXRvcnkuaHRtMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMBIGA1UdEwEB/wQI # MAYBAf8CAQAwHwYDVR0jBBgwFoAU2UEpsA8PY2zvadf1zSmepEhqMOYwcAYDVR0f # BGkwZzBloGOgYYZfaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwv # TWljcm9zb2Z0JTIwSUQlMjBWZXJpZmllZCUyMENvZGUlMjBTaWduaW5nJTIwUENB # JTIwMjAyMS5jcmwwfQYIKwYBBQUHAQEEcTBvMG0GCCsGAQUFBzAChmFodHRwOi8v # d3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01pY3Jvc29mdCUyMElEJTIw # VmVyaWZpZWQlMjBDb2RlJTIwU2lnbmluZyUyMFBDQSUyMDIwMjEuY3J0MA0GCSqG # SIb3DQEBDAUAA4ICAQCQdVoZ/U0m38l2iKaZFlsxavptpoOLyaR1a9ZK2TSF1kOn # FJhMDse6KkCgsveoiEjXTVc6Xt86IKHn76Nk5qZB0BXv2iMRQ2giAJmYvZcmstoZ # qfB2M3Kd5wnJhUJOtF/b6HsqSelY6nhrF06zor1lDmDQixBZcLB9zR1+RKQso1je # kNxYuUk+HaN3k1S57qk0O//YbkwU0mELCW04N5vICMZx5T5c7Nq/7uLvbVhCdD7f # 2bZpA4U7vOkB1ooB4AaER3pjoJ0Mad5LFyi6Na9p9Zu/hrLeOjU5FItS5Yxsqvlf # XxAThJ176CmkYstKRmytSHZ7JhKRfV6e9Zftk/ODb/CK4pGVAVqsOf4337bQGrOH # HCQ3IvN9gmnUuDh8JdvbheoWPHxIN1GB5sUiY584tXN7xdD8LCSsRqJvQ8e7a3gZ # WTgViugRs1QWq+N0G9Nje6JHlN1CjJehge+H5PGktJja+juGEr0P+ukSkcL6qaZx # FQTh3SDI71lvW++3bl/Ezd6SO8N9Udw+reoyvRHCyTiSsplZQSBTVJdPmo3qCpGu # yHFtPo5CBn3/FPTiqJd3M9BHoqKd0G9Kmg6fGcAvFwnLNXA2kov727wRljL3ypfq # L7iAT/Ynpxul6RwHRlcOf9dDGg1RRvr92NP/CWVXIb68geR2rvU/NsfmtjF1wDCC # B54wggWGoAMCAQICEzMAAAAHh6M0o3uljhwAAAAAAAcwDQYJKoZIhvcNAQEMBQAw # dzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjFI # MEYGA1UEAxM/TWljcm9zb2Z0IElkZW50aXR5IFZlcmlmaWNhdGlvbiBSb290IENl # cnRpZmljYXRlIEF1dGhvcml0eSAyMDIwMB4XDTIxMDQwMTIwMDUyMFoXDTM2MDQw # MTIwMTUyMFowYzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jw # b3JhdGlvbjE0MDIGA1UEAxMrTWljcm9zb2Z0IElEIFZlcmlmaWVkIENvZGUgU2ln # bmluZyBQQ0EgMjAyMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALLw # wK8ZiCji3VR6TElsaQhVCbRS/3pK+MHrJSj3Zxd3KU3rlfL3qrZilYKJNqztA9OQ # acr1AwoNcHbKBLbsQAhBnIB34zxf52bDpIO3NJlfIaTE/xrweLoQ71lzCHkD7A4A # s1Bs076Iu+mA6cQzsYYH/Cbl1icwQ6C65rU4V9NQhNUwgrx9rGQ//h890Q8JdjLL # w0nV+ayQ2Fbkd242o9kH82RZsH3HEyqjAB5a8+Ae2nPIPc8sZU6ZE7iRrRZywRmr # KDp5+TcmJX9MRff241UaOBs4NmHOyke8oU1TYrkxh+YeHgfWo5tTgkoSMoayqoDp # HOLJs+qG8Tvh8SnifW2Jj3+ii11TS8/FGngEaNAWrbyfNrC69oKpRQXY9bGH6jn9 # NEJv9weFxhTwyvx9OJLXmRGbAUXN1U9nf4lXezky6Uh/cgjkVd6CGUAf0K+Jw+GE # /5VpIVbcNr9rNE50Sbmy/4RTCEGvOq3GhjITbCa4crCzTTHgYYjHs1NbOc6brH+e # KpWLtr+bGecy9CrwQyx7S/BfYJ+ozst7+yZtG2wR461uckFu0t+gCwLdN0A6cFtS # RtR8bvxVFyWwTtgMMFRuBa3vmUOTnfKLsLefRaQcVTgRnzeLzdpt32cdYKp+dhr2 # ogc+qM6K4CBI5/j4VFyC4QFeUP2YAidLtvpXRRo3AgMBAAGjggI1MIICMTAOBgNV # HQ8BAf8EBAMCAYYwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFNlBKbAPD2Ns # 72nX9c0pnqRIajDmMFQGA1UdIARNMEswSQYEVR0gADBBMD8GCCsGAQUFBwIBFjNo # dHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL0RvY3MvUmVwb3NpdG9yeS5o # dG0wGQYJKwYBBAGCNxQCBAweCgBTAHUAYgBDAEEwDwYDVR0TAQH/BAUwAwEB/zAf # BgNVHSMEGDAWgBTIftJqhSobyhmYBAcnz1AQT2ioojCBhAYDVR0fBH0wezB5oHeg # dYZzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0 # JTIwSWRlbnRpdHklMjBWZXJpZmljYXRpb24lMjBSb290JTIwQ2VydGlmaWNhdGUl # MjBBdXRob3JpdHklMjAyMDIwLmNybDCBwwYIKwYBBQUHAQEEgbYwgbMwgYEGCCsG # AQUFBzAChnVodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01p # Y3Jvc29mdCUyMElkZW50aXR5JTIwVmVyaWZpY2F0aW9uJTIwUm9vdCUyMENlcnRp # ZmljYXRlJTIwQXV0aG9yaXR5JTIwMjAyMC5jcnQwLQYIKwYBBQUHMAGGIWh0dHA6 # Ly9vbmVvY3NwLm1pY3Jvc29mdC5jb20vb2NzcDANBgkqhkiG9w0BAQwFAAOCAgEA # fyUqnv7Uq+rdZgrbVyNMul5skONbhls5fccPlmIbzi+OwVdPQ4H55v7VOInnmezQ # EeW4LqK0wja+fBznANbXLB0KrdMCbHQpbLvG6UA/Xv2pfpVIE1CRFfNF4XKO8XYE # a3oW8oVH+KZHgIQRIwAbyFKQ9iyj4aOWeAzwk+f9E5StNp5T8FG7/VEURIVWArbA # zPt9ThVN3w1fAZkF7+YU9kbq1bCR2YD+MtunSQ1Rft6XG7b4e0ejRA7mB2IoX5hN # h3UEauY0byxNRG+fT2MCEhQl9g2i2fs6VOG19CNep7SquKaBjhWmirYyANb0RJSL # WjinMLXNOAga10n8i9jqeprzSMU5ODmrMCJE12xS/NWShg/tuLjAsKP6SzYZ+1Ry # 358ZTFcx0FS/mx2vSoU8s8HRvy+rnXqyUJ9HBqS0DErVLjQwK8VtsBdekBmdTbQV # oCgPCqr+PDPB3xajYnzevs7eidBsM71PINK2BoE2UfMwxCCX3mccFgx6UsQeRSdV # VVNSyALQe6PT12418xon2iDGE81OGCreLzDcMAZnrUAx4XQLUz6ZTl65yPUiOh3k # 7Yww94lDf+8oG2oZmDh5O1Qe38E+M3vhKwmzIeoB1dVLlz4i3IpaDcR+iuGjH2Td # aC1ZOmBXiCRKJLj4DT2uhJ04ji+tHD6n58vhavFIrmcxghqUMIIakAIBATBxMFox # CzAJBgNVBAYTAlVTMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKzAp # BgNVBAMTIk1pY3Jvc29mdCBJRCBWZXJpZmllZCBDUyBFT0MgQ0EgMDQCEzMABN83 # wV0KQIA53+UAAAAE3zcwDQYJYIZIAWUDBAIBBQCgXjAQBgorBgEEAYI3AgEMMQIw # ADAZBgkqhkiG9w0BCQMxDAYKKwYBBAGCNwIBBDAvBgkqhkiG9w0BCQQxIgQgZ18N # ZunZgmXIl+u0jKXG4CrLD+tWd2hWRBi65iqPdoIwDQYJKoZIhvcNAQEBBQAEggGA # I1j7MTdvsagG+BwHRymda2ZYAwp6or4YoX3FjIXyVXy3o2DkB6qgjKNAFxgNZ3OP # V2e8WGRA38GHZolXhpwz49Pz3xKh6P9LWk2Uy6HuMo3QSNbNieUAAbEZ1am97Sbq # JRtQk7mHjAv4kozVHvmCAeC1CjywYzcAEQG6eD+5sRDp1D+amHMsKzK3H/NnK0lY # Q1hipTB5XXr3LPMMK60QFk8sJAvOWMiHMlKYddjH6+qUzAJUqkOUIwTEbVRZBP6H # Y9y1eXFlenkeaV7D/7CubIfZ+QMM3zdzG2A1VIw+oERrFmYbPgaMh86Rd5sMi9x0 # +KbQeJggTPbFo1Low0DCckzltUHztjkiM3VnKHPbSsrEn/N4o8EvnQvIkmEqa5QO # 6EqhrArUqVgRVQJ3e5Q5/n1ioYL8+UDytyTLagyj6QpW5vvTANIQpJHEajH8L77E # 3IAfLZLhLHlqgURKmybxM9FYMqn790UfbtQNhOF0CIspJdd+xqsVWVb294lERdMW # oYIYFDCCGBAGCisGAQQBgjcDAwExghgAMIIX/AYJKoZIhvcNAQcCoIIX7TCCF+kC # AQMxDzANBglghkgBZQMEAgEFADCCAWIGCyqGSIb3DQEJEAEEoIIBUQSCAU0wggFJ # AgEBBgorBgEEAYRZCgMBMDEwDQYJYIZIAWUDBAIBBQAEIIk4RPhI7hJ7hacocBIt # GoPC/bIou7dSN1wZfJz0LwErAgZqhEjmFuYYEzIwMjYwODI1MTIxNTI2LjEyOFow # BIACAfSggeGkgd4wgdsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9u # MRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRp # b24xJTAjBgNVBAsTHE1pY3Jvc29mdCBBbWVyaWNhIE9wZXJhdGlvbnMxJzAlBgNV # BAsTHm5TaGllbGQgVFNTIEVTTjpBNTAwLTA1RTAtRDk0NzE1MDMGA1UEAxMsTWlj # cm9zb2Z0IFB1YmxpYyBSU0EgVGltZSBTdGFtcGluZyBBdXRob3JpdHmggg8hMIIH # gjCCBWqgAwIBAgITMwAAAAXlzw//Zi7JhwAAAAAABTANBgkqhkiG9w0BAQwFADB3 # MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMUgw # RgYDVQQDEz9NaWNyb3NvZnQgSWRlbnRpdHkgVmVyaWZpY2F0aW9uIFJvb3QgQ2Vy # dGlmaWNhdGUgQXV0aG9yaXR5IDIwMjAwHhcNMjAxMTE5MjAzMjMxWhcNMzUxMTE5 # MjA0MjMxWjBhMQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv # cmF0aW9uMTIwMAYDVQQDEylNaWNyb3NvZnQgUHVibGljIFJTQSBUaW1lc3RhbXBp # bmcgQ0EgMjAyMDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJ5851Jj # /eDFnwV9Y7UGIqMcHtfnlzPREwW9ZUZHd5HBXXBvf7KrQ5cMSqFSHGqg2/qJhYqO # QxwuEQXG8kB41wsDJP5d0zmLYKAY8Zxv3lYkuLDsfMuIEqvGYOPURAH+Ybl4SJEE # Snt0MbPEoKdNihwM5xGv0rGofJ1qOYSTNcc55EbBT7uq3wx3mXhtVmtcCEr5ZKTk # KKE1CxZvNPWdGWJUPC6e4uRfWHIhZcgCsJ+sozf5EeH5KrlFnxpjKKTavwfFP6Xa # GZGWUG8TZaiTogRoAlqcevbiqioUz1Yt4FRK53P6ovnUfANjIgM9JDdJ4e0qiDRm # 5sOTiEQtBLGd9Vhd1MadxoGcHrRCsS5rO9yhv2fjJHrmlQ0EIXmp4DhDBieKUGR+ # eZ4CNE3ctW4uvSDQVeSp9h1SaPV8UWEfyTxgGjOsRpeexIveR1MPTVf7gt8hY64X # NPO6iyUGsEgt8c2PxF87E+CO7A28TpjNq5eLiiunhKbq0XbjkNoU5JhtYUrlmAbp # xRjb9tSreDdtACpm3rkpxp7AQndnI0Shu/fk1/rE3oWsDqMX3jjv40e8KN5YsJBn # czyWB4JyeeFMW3JBfdeAKhzohFe8U5w9WuvcP1E8cIxLoKSDzCCBOu0hWdjzKNu8 # Y5SwB1lt5dQhABYyzR3dxEO/T1K/BVF3rV69AgMBAAGjggIbMIICFzAOBgNVHQ8B # Af8EBAMCAYYwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFGtpKDo1L0hjQM97 # 2K9J6T7ZPdshMFQGA1UdIARNMEswSQYEVR0gADBBMD8GCCsGAQUFBwIBFjNodHRw # Oi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL0RvY3MvUmVwb3NpdG9yeS5odG0w # EwYDVR0lBAwwCgYIKwYBBQUHAwgwGQYJKwYBBAGCNxQCBAweCgBTAHUAYgBDAEEw # DwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTIftJqhSobyhmYBAcnz1AQT2io # ojCBhAYDVR0fBH0wezB5oHegdYZzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3Br # aW9wcy9jcmwvTWljcm9zb2Z0JTIwSWRlbnRpdHklMjBWZXJpZmljYXRpb24lMjBS # b290JTIwQ2VydGlmaWNhdGUlMjBBdXRob3JpdHklMjAyMDIwLmNybDCBlAYIKwYB # BQUHAQEEgYcwgYQwgYEGCCsGAQUFBzAChnVodHRwOi8vd3d3Lm1pY3Jvc29mdC5j # b20vcGtpb3BzL2NlcnRzL01pY3Jvc29mdCUyMElkZW50aXR5JTIwVmVyaWZpY2F0 # aW9uJTIwUm9vdCUyMENlcnRpZmljYXRlJTIwQXV0aG9yaXR5JTIwMjAyMC5jcnQw # DQYJKoZIhvcNAQEMBQADggIBAF+Idsd+bbVaFXXnTHho+k7h2ESZJRWluLE0Oa/p # O+4ge/XEizXvhs0Y7+KVYyb4nHlugBesnFqBGEdC2IWmtKMyS1OWIviwpnK3aL5J # edwzbeBF7POyg6IGG/XhhJ3UqWeWTO+Czb1c2NP5zyEh89F72u9UIw+IfvM9lzDm # c2O2END7MPnrcjWdQnrLn1Ntday7JSyrDvBdmgbNnCKNZPmhzoa8PccOiQljjTW6 # GePe5sGFuRHzdFt8y+bN2neF7Zu8hTO1I64XNGqst8S+w+RUdie8fXC1jKu3m9KG # IqF4aldrYBamyh3g4nJPj/LR2CBaLyD+2BuGZCVmoNR/dSpRCxlot0i79dKOChmo # ONqbMI8m04uLaEHAv4qwKHQ1vBzbV/nG89LDKbRSSvijmwJwxRxLLpMQ/u4xXxFf # R4f/gksSkbJp7oqLwliDm/h+w0aJ/U5ccnYhYb7vPKNMN+SZDWycU5ODIRfyoGl5 # 9BsXR/HpRGtiJquOYGmvA/pk5vC1lcnbeMrcWD/26ozePQ/TWfNXKBOmkFpvPE8C # H+EeGGWzqTCjdAsno2jzTeNSxlx3glDGJgcdz5D/AAxw9Sdgq/+rY7jjgs7X6fqP # TXPmaCAJKVHAP19oEjJIBwD1LyHbaEgBxFCogYSOiUIr0Xqcr1nJfiWG2GwYe6Zo # AF1bMIIHlzCCBX+gAwIBAgITMwAAAFZ+j51YCI7pYAAAAAAAVjANBgkqhkiG9w0B # AQwFADBhMQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0 # aW9uMTIwMAYDVQQDEylNaWNyb3NvZnQgUHVibGljIFJTQSBUaW1lc3RhbXBpbmcg # Q0EgMjAyMDAeFw0yNTEwMjMyMDQ2NTFaFw0yNjEwMjIyMDQ2NTFaMIHbMQswCQYD # VQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEe # MBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3Nv # ZnQgQW1lcmljYSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046 # QTUwMC0wNUUwLUQ5NDcxNTAzBgNVBAMTLE1pY3Jvc29mdCBQdWJsaWMgUlNBIFRp # bWUgU3RhbXBpbmcgQXV0aG9yaXR5MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC # CgKCAgEAtKWfm/ul027/d8Rlb8Mn/g0QUvvLqY2Vsy3tI8U2tFSspTZomZOD3BHT # 8LkR+RrhMJgb1VjAKFNysaK9cLSXifPGSIBrPCgs9P4y24lrJEmrV6Q5z4BmqMhI # PrZhEvZnWpCS4HO7jYSei/nxmC7/1Er+l5Lg3PmSxb8d2IVcARxSw1B4mxB6XI0n # kel9wa1dYb2wfGpofraFmxZOxT9eNht4LH0RBSVueba6ZNpjS/0gtfm7qiIiyP6p # 6PRzTTbMnVqsHnV/d/rW0zHx+Q+QNZ5wUqKmTZJB9hU853+2pX5rDfK32uNY9/WB # OAmzbqgpEdQkbiMavUMyUDShmycIvgHdQnS207sTj8M+kJL3tOdahPuPqMwsaCCg # dfwwQx0O9TKe7FSvbAEYs1AnldCl/KHGZCOVvUNqjyL10JLe0/+GD9/ynqXGWFpX # OjaunvZ/cKROhjN4M5e6xx0b2miqcPii4/ii2ZheKallJET7CKlpFShs3wyg6F/f # ojQxQvPnbWD4Nyx6lhjWjwmoLcx6w1FSCtavLCly33BLRSlTU4qKUxaa8d7YN7Eq # pn9XO0SY0umOvKFXrWH7rxl+9iaicitdnTTksAnRjvekdKT3lg7lRMfmfZU8vXNi # N0UYJzT9EjqjRm0uN/h0oXxPhNfPYqeFbyPXGGxzaYUz6zx3qTcCAwEAAaOCAcsw # ggHHMB0GA1UdDgQWBBS+tjPyu6tZ/h5GsyLvyz1H+FNIWjAfBgNVHSMEGDAWgBRr # aSg6NS9IY0DPe9ivSek+2T3bITBsBgNVHR8EZTBjMGGgX6BdhltodHRwOi8vd3d3 # Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNyb3NvZnQlMjBQdWJsaWMlMjBS # U0ElMjBUaW1lc3RhbXBpbmclMjBDQSUyMDIwMjAuY3JsMHkGCCsGAQUFBwEBBG0w # azBpBggrBgEFBQcwAoZdaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9j # ZXJ0cy9NaWNyb3NvZnQlMjBQdWJsaWMlMjBSU0ElMjBUaW1lc3RhbXBpbmclMjBD # QSUyMDIwMjAuY3J0MAwGA1UdEwEB/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUH # AwgwDgYDVR0PAQH/BAQDAgeAMGYGA1UdIARfMF0wUQYMKwYBBAGCN0yDfQEBMEEw # PwYIKwYBBQUHAgEWM2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvRG9j # cy9SZXBvc2l0b3J5Lmh0bTAIBgZngQwBBAIwDQYJKoZIhvcNAQEMBQADggIBAA4D # qAXEsO26j/La7Fgn/Qifit8xuZekqZ57+Ye+sH/hRTbEEjGYrZgsqwR/lUUfKCFp # bZF8msaZPQJOR4YYUEU8XyjLrn8Y1jCSmoxh9l7tWiSoc/JFBw356JAmzGGxeBA2 # EWSxRuTr1AuZe6nYaN8/wtFkiHcs8gMadxXBs6DxVhyu5YnhLPQkfumKm3lFftwE # 7pieV7f1lskmlgsC6AeSGCzGPZUgCvcH5Tv/Qe9z7bIImSD3SuzhOIwaP+eKQTYf # 67TifyJKkWQSdGfTA6Kcu41k8LB6oPK+MLk1jbxxK5wPqLSL62xjK04SBXHEJSEn # sFt0zxWkxP/lgej1DxqUnmrYEdkxvzKSHIAqFWSZul/5hI+vJxvFPhsNQBEk4cSu # lDkJQpcdVi/gmf/mHFOYhDBjsa15s4L+2sBil3XV/T8RiR66Q8xYvTLRWxd2dVsr # OoCwnsU4WIeiC0JinCv1WLHEh7Qyzr9RSr4kKJLWdpNYLhgjkojTmEkAjFO774t3 # xB7enbvIF0GOsV19xnCUzq9EGKyt0gMuaphKlNjJ+aTpjWMZDGo+GOKsnp93Hmft # ml0Syp3F9+M3y+y6WJGUZoIZJq227jDjjEndtpUrh9BdPdVIfVJD/Au81Rzh05UH # AivorQ3Os8PELHIgiOd9TWzbdgmGzcILt/ddVQERMYIHRjCCB0ICAQEweDBhMQsw # CQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTIwMAYD # VQQDEylNaWNyb3NvZnQgUHVibGljIFJTQSBUaW1lc3RhbXBpbmcgQ0EgMjAyMAIT # MwAAAFZ+j51YCI7pYAAAAAAAVjANBglghkgBZQMEAgEFAKCCBJ8wEQYLKoZIhvcN # AQkQAg8xAgUAMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAcBgkqhkiG9w0B # CQUxDxcNMjYwODI1MTIxNTI2WjAvBgkqhkiG9w0BCQQxIgQgURRD8RlgaoZpoJ5l # WaBA/kc+Xf+tyHqy7ZpXB7w1m9cwgbkGCyqGSIb3DQEJEAIvMYGpMIGmMIGjMIGg # BCC2DDMlTaTj8JV3iTg5Xnpe4CSH60143Z+X9o5NBgMMqDB8MGWkYzBhMQswCQYD # VQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTIwMAYDVQQD # EylNaWNyb3NvZnQgUHVibGljIFJTQSBUaW1lc3RhbXBpbmcgQ0EgMjAyMAITMwAA # AFZ+j51YCI7pYAAAAAAAVjCCA2EGCyqGSIb3DQEJEAISMYIDUDCCA0yhggNIMIID # RDCCAiwCAQEwggEJoYHhpIHeMIHbMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2Fz # aGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENv # cnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25z # MScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046QTUwMC0wNUUwLUQ5NDcxNTAzBgNV # BAMTLE1pY3Jvc29mdCBQdWJsaWMgUlNBIFRpbWUgU3RhbXBpbmcgQXV0aG9yaXR5 # oiMKAQEwBwYFKw4DAhoDFQD/c/cpFSqQWYBeXggyRJ2ZbvYEEaBnMGWkYzBhMQsw # CQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTIwMAYD # VQQDEylNaWNyb3NvZnQgUHVibGljIFJTQSBUaW1lc3RhbXBpbmcgQ0EgMjAyMDAN # BgkqhkiG9w0BAQsFAAIFAO44Ad0wIhgPMjAyNjA4MjUxMTU4MjFaGA8yMDI2MDgy # NjExNTgyMVowdzA9BgorBgEEAYRZCgQBMS8wLTAKAgUA7jgB3QIBADAKAgEAAgIV # uQIB/zAHAgEAAgIS2zAKAgUA7jlTXQIBADA2BgorBgEEAYRZCgQCMSgwJjAMBgor # BgEEAYRZCgMCoAowCAIBAAIDB6EgoQowCAIBAAIDAYagMA0GCSqGSIb3DQEBCwUA # A4IBAQBbnO48VKdo3LMJk4+kcoLAscYZ7aF+3y1VcccLGW8kGqz/p330Y+lQ1J0X # Z3GzaKA/LvHNgYcsmd2ZBRKuVmqYFi9juRgz7tX5RSYRyXqZ+8KFu8g4xScjl2Ot # PDk2S6uKjuVhTdcSd3/cPk6gOWg+lXqU3N8kt/lnoP6OKTa44RsQl7GU5oTeCSph # 6dpZF5WvgYkPARAxmdXHmgj1/cvfYEFjvHEyLC+QyVyT0q/KXjFXDUrRM8qd3225 # L4ov8dCZ9q/36NIsc4e8eyKIF+IySjp3ddR9UrGGuRb98PSVRNd3x08CyHoWMCqJ # jhDDranmPbioHG8o0AGQ0/p7K5HgMA0GCSqGSIb3DQEBAQUABIICACXlwVIzciE0 # qFDBCOzuH79bEjfU51Ql6Wh/Jh1GjKggXm43Rl7ERGkNXz631l5PMUisBrSOi/0w # hHgi6WGOb/uBEXCnMAmjG7wTxhiQxE8XEnWewZcxreqgE0NPV6uwyvT72Yxt8Xi4 # +8EP/TiZpzzUZMa/vkTAaRTEnjjDMJh17kZHTjoCeHNI24v1xjrl3e79yHPYjqof # VQL+zGbEb0g38ZCqiKRhEjEo4J00x4338xZqDUp3pif0li2BWGzphwziWGdgtZMT # ax+9mU53mgaz5mQj15XrcdLkYqhdzVVPt/Atl5Cfp4td/CLTS4/i4mbqQKbata22 # 9QP7cpgkZgsWGXeZP4dpZMQNwp92KtjENvkN40+NTMypPypxVenjkT0f88AFnM29 # jXnAI7JImDtdlrNT8jyOkUH9C8cH8Dcq8bvw3cKgdLmg5CzbjF5M2M9wm7cPS17B # pv/ax9Vu2Xy0zqPxo8k0VgWiOy3t/QlTbz3oPupckQIHxkdBk7v2Xzx9PBdjvpXv # waeQ8eewl7OVxq1kNjhXD8n7AZAOGuQBr7bZStIx7hS0Uk6PpKZlE7+Aj/idbXAh # /strWlOKJnMySggbUdr8t9N59Hx2UQ5RTgcvUtI3BnYTjXdMdw1lVRYJyPAKPbsz # PsXCj1wWHyGe6CLE+oNmY0G75FX6ZNZV # SIG # End signature block |