Private/Add-OwnerCandidate.ps1
|
function New-OwnerCandidate { param( [Parameter(Mandatory = $true)] [string]$Candidate, [Parameter(Mandatory = $true)] [string]$CandidateType, [Parameter(Mandatory = $true)] [string]$Confidence, [Parameter(Mandatory = $true)] [string]$Relationship, [Parameter(Mandatory = $true)] [string]$Signal, [Parameter(Mandatory = $true)] [string]$EvidenceId, [Parameter(Mandatory = $true)] [string]$EvidenceSource, [string]$EvidenceValue = "", [string]$Reason = "" ) return [pscustomobject]@{ candidate = $Candidate candidateType = $CandidateType confidence = $Confidence relationship = $Relationship signal = $Signal evidenceId = $EvidenceId evidenceSource = $EvidenceSource evidenceValue = $EvidenceValue reason = $Reason } } function Get-OwnerCandidatePolicyScore { param( [Parameter(Mandatory = $true)] [hashtable]$Rule, [string]$CandidateType = "" ) if ($Rule.ScoreByCandidateType) { if (-not [string]::IsNullOrWhiteSpace($CandidateType) -and $Rule.ScoreByCandidateType.ContainsKey($CandidateType)) { return [int]$Rule.ScoreByCandidateType[$CandidateType] } if ($Rule.ScoreByCandidateType.ContainsKey("Default")) { return [int]$Rule.ScoreByCandidateType.Default } } return [int]$Rule.Score } function ConvertTo-OwnerConfidence { param([int]$Score) if ($Score -ge 80) { return "HIGH" } if ($Score -ge 50) { return "MED" } return "LOW" } function ConvertTo-OwnerCandidateType { param([string]$ObjectType) switch -Regex ($ObjectType) { "user|#microsoft\.graph\.user" { return "User" } "group|#microsoft\.graph\.group" { return "Group" } default { if ([string]::IsNullOrWhiteSpace($ObjectType)) { return "Unknown" } return $ObjectType } } } function Add-OwnerCandidateFromGraphOwner { param( [Parameter(Mandatory = $true)] [object]$Owner, [Parameter(Mandatory = $true)] [object]$EnterpriseApplication, [Parameter(Mandatory = $true)] [hashtable]$Rule ) $candidateType = ConvertTo-OwnerCandidateType -ObjectType ([string]$Owner.objectType) if ($candidateType -eq "User") { $candidateName = [string]$Owner.userPrincipalName if ([string]::IsNullOrWhiteSpace($candidateName)) { $candidateName = [string]$Owner.mail } if ([string]::IsNullOrWhiteSpace($candidateName)) { $candidateName = [string]$Owner.displayName } } else { $candidateName = [string]$Owner.displayName } if ([string]::IsNullOrWhiteSpace($candidateName)) { $candidateName = [string]$Owner.objectId } $ownerSource = [string]$Owner.ownerSource if ([string]::IsNullOrWhiteSpace($ownerSource)) { $ownerSource = "ServicePrincipal" } $ownerEvidenceBase = "/servicePrincipals/$($EnterpriseApplication.objectId)" $ownerReason = "Direct Microsoft Graph owner on the service principal." if ($ownerSource -eq "Application" -and -not [string]::IsNullOrWhiteSpace([string]$EnterpriseApplication.applicationObjectId)) { $ownerEvidenceBase = "/applications/$($EnterpriseApplication.applicationObjectId)" $ownerReason = "Direct Microsoft Graph owner on the application registration." } return New-OwnerCandidate ` -Candidate $candidateName ` -CandidateType $candidateType ` -Confidence (ConvertTo-OwnerConfidence -Score (Get-OwnerCandidatePolicyScore -Rule $Rule -CandidateType $candidateType)) ` -Relationship "Direct" ` -Signal ([string]$Rule.Signal) ` -EvidenceId ("{0}/owners/{1}" -f $ownerEvidenceBase, [string]$Owner.objectId) ` -EvidenceSource "$ownerEvidenceBase/owners" ` -EvidenceValue ([string]$Owner.objectId) ` -Reason $ownerReason } function Add-OwnerCandidateFromDirectoryRelationship { param( [Parameter(Mandatory = $true)] [object]$MemberOf, [Parameter(Mandatory = $true)] [object]$EnterpriseApplication, [Parameter(Mandatory = $true)] [hashtable]$Rule ) $candidateType = ConvertTo-OwnerCandidateType -ObjectType ([string]$MemberOf.objectType) $candidateName = [string]$MemberOf.displayName if ([string]::IsNullOrWhiteSpace($candidateName)) { $candidateName = [string]$MemberOf.objectId } return New-OwnerCandidate ` -Candidate $candidateName ` -CandidateType $candidateType ` -Confidence (ConvertTo-OwnerConfidence -Score (Get-OwnerCandidatePolicyScore -Rule $Rule -CandidateType $candidateType)) ` -Relationship "Indirect" ` -Signal ([string]$Rule.Signal) ` -EvidenceId ("/servicePrincipals/{0}/memberOf/{1}" -f $EnterpriseApplication.objectId, [string]$MemberOf.objectId) ` -EvidenceSource "/servicePrincipals/$($EnterpriseApplication.objectId)/memberOf" ` -EvidenceValue ([string]$MemberOf.objectId) ` -Reason "The service principal is a member of this directory object." } function Add-OwnerCandidateFromCoAssignedRoleCandidate { param( [Parameter(Mandatory = $true)] [object]$CoAssignee, [Parameter(Mandatory = $true)] [hashtable]$Rule ) $candidateType = ConvertTo-OwnerCandidateType -ObjectType ([string]$CoAssignee.principalType) if ($candidateType -eq "Unknown") { return $null } if ($candidateType -eq "User") { $candidateName = [string]$CoAssignee.principalName if ([string]::IsNullOrWhiteSpace($candidateName)) { $candidateName = [string]$CoAssignee.principalDisplayName } } else { $candidateName = [string]$CoAssignee.principalDisplayName } if ([string]::IsNullOrWhiteSpace($candidateName)) { $candidateName = [string]$CoAssignee.principalId } if ([string]::IsNullOrWhiteSpace($candidateName)) { return $null } $candidateScore = Get-OwnerCandidatePolicyScore -Rule $Rule -CandidateType $candidateType if ($candidateType -eq "User" -and [bool]$CoAssignee.isStorageDataReadRole -and $candidateScore -lt 50) { $candidateScore = 50 } return New-OwnerCandidate ` -Candidate $candidateName ` -CandidateType $candidateType ` -Confidence (ConvertTo-OwnerConfidence -Score $candidateScore) ` -Relationship "Indirect" ` -Signal ([string]$Rule.Signal) ` -EvidenceId ([string]$CoAssignee.scope) ` -EvidenceSource ([string]$CoAssignee.scope) ` -EvidenceValue ([string]$CoAssignee.roleDefinitionName) ` -Reason "This principal has Azure RBAC on the same scope as the inspected service principal." } function Add-OwnerCandidateFromAzureActivityEvidence { param( [Parameter(Mandatory = $true)] [object]$Activity, [Parameter(Mandatory = $true)] [hashtable]$Rule ) $candidateName = [string]$Activity.callerName if ([string]::IsNullOrWhiteSpace($candidateName)) { $candidateName = [string]$Activity.caller } if ([string]::IsNullOrWhiteSpace($candidateName)) { return $null } return New-OwnerCandidate ` -Candidate $candidateName ` -CandidateType "ActivityCaller" ` -Confidence (ConvertTo-OwnerConfidence -Score (Get-OwnerCandidatePolicyScore -Rule $Rule -CandidateType "ActivityCaller")) ` -Relationship "Indirect" ` -Signal ([string]$Rule.Signal) ` -EvidenceId ([string]$Activity.resourceId) ` -EvidenceSource ([string]$Activity.resourceId) ` -EvidenceValue ([string]$Activity.operationNameValue) ` -Reason "Recent Azure activity matched the inspected service principal; this is weak ownership evidence." } function Get-OwnerCandidateRbacScopeActivityCallerName { param([object]$ActivityCaller) $caller = [string]$ActivityCaller.caller if ($caller -match "@") { return $caller } $callerName = [string]$ActivityCaller.callerName if (-not [string]::IsNullOrWhiteSpace($callerName)) { return $callerName } if (-not [string]::IsNullOrWhiteSpace($caller)) { return $caller } $callerObjectId = [string]$ActivityCaller.callerObjectId if (-not [string]::IsNullOrWhiteSpace($callerObjectId)) { return $callerObjectId } $callerAppId = [string]$ActivityCaller.callerAppId if (-not [string]::IsNullOrWhiteSpace($callerAppId)) { return $callerAppId } return [string]$ActivityCaller.callerKey } function Get-OwnerCandidateRbacScopeActivityCallerType { param([object]$ActivityCaller) return Get-OwnerLensPrincipalType ` -Caller ([string]$ActivityCaller.caller) ` -AppId ([string]$ActivityCaller.callerAppId) ` -Fallback "ActivityCaller" } function Add-OwnerCandidateFromRbacScopeActivityCaller { param( [Parameter(Mandatory = $true)] [object]$ActivityCaller, [Parameter(Mandatory = $true)] [hashtable]$Rule ) $candidateName = Get-OwnerCandidateRbacScopeActivityCallerName -ActivityCaller $ActivityCaller if ([string]::IsNullOrWhiteSpace($candidateName)) { return $null } $evidenceId = [string](@($ActivityCaller.rbacScopes) | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) } | Select-Object -First 1) if ([string]::IsNullOrWhiteSpace($evidenceId)) { $evidenceId = [string]$ActivityCaller.callerKey } $candidateType = Get-OwnerCandidateRbacScopeActivityCallerType -ActivityCaller $ActivityCaller return New-OwnerCandidate ` -Candidate $candidateName ` -CandidateType $candidateType ` -Confidence (ConvertTo-OwnerConfidence -Score (Get-OwnerCandidatePolicyScore -Rule $Rule -CandidateType $candidateType)) ` -Relationship "Indirect" ` -Signal ([string]$Rule.Signal) ` -EvidenceId $evidenceId ` -EvidenceSource "AzureActivity" ` -EvidenceValue ("events={0},lastSeen={1}" -f [string]$ActivityCaller.eventCount, [string]$ActivityCaller.lastSeen) ` -Reason "Recent Azure RBAC scope activity was performed by this principal under a scope where the inspected service principal has RBAC." } function Get-OwnerCandidateSasGeneratorName { param([object]$BlobRead) $sasGeneratorUpn = [string]$BlobRead.sasGeneratorUpn if (-not [string]::IsNullOrWhiteSpace($sasGeneratorUpn)) { return $sasGeneratorUpn } $sasGeneratorObjectId = [string]$BlobRead.sasGeneratorObjectId if (-not [string]::IsNullOrWhiteSpace($sasGeneratorObjectId)) { return $sasGeneratorObjectId } return [string]$BlobRead.sasGeneratorAppId } function Get-OwnerCandidateTextValue { param( [AllowNull()] [object]$Value, [string]$Fallback = "" ) $text = [string]$Value if ([string]::IsNullOrWhiteSpace($text)) { return $Fallback } return $text } function Get-OwnerCandidateSasGeneratorType { param([object]$BlobRead) if (-not [string]::IsNullOrWhiteSpace([string]$BlobRead.sasGeneratorUpn)) { return "User" } if (-not [string]::IsNullOrWhiteSpace([string]$BlobRead.sasGeneratorAppId)) { return "ServicePrincipal" } return "SasGenerator" } function Add-OwnerCandidateFromSasGeneratorGroup { param( [Parameter(Mandatory = $true)] [object]$SasGeneratorGroup, [Parameter(Mandatory = $true)] [hashtable]$Rule ) $sasEvents = @($SasGeneratorGroup.Group | Sort-Object eventTimestamp) $firstSasEvent = $sasEvents | Select-Object -First 1 $candidateName = Get-OwnerCandidateSasGeneratorName -BlobRead $firstSasEvent if ([string]::IsNullOrWhiteSpace($candidateName)) { return $null } $evidenceId = [string]$firstSasEvent.storageAccountResourceId if ([string]::IsNullOrWhiteSpace($evidenceId)) { $evidenceId = [string]$firstSasEvent.uri } $evidenceValues = @($sasEvents | ForEach-Object { Get-OwnerCandidateTextValue -Value $_.operationName -Fallback $_.sasSignedPermissions } | Where-Object { -not [string]::IsNullOrWhiteSpace([string]$_) } | Sort-Object -Unique) $candidateType = Get-OwnerCandidateSasGeneratorType -BlobRead $firstSasEvent return New-OwnerCandidate ` -Candidate $candidateName ` -CandidateType $candidateType ` -Confidence (ConvertTo-OwnerConfidence -Score (Get-OwnerCandidatePolicyScore -Rule $Rule -CandidateType $candidateType)) ` -Relationship "Indirect" ` -Signal ([string]$Rule.Signal) ` -EvidenceId $evidenceId ` -EvidenceSource "StorageBlobLogs" ` -EvidenceValue ([string]($evidenceValues -join ",")) ` -Reason "StorageBlobLogs identify this principal as the generator of a user delegation SAS used for blob data-plane access." } function Add-OwnerCandidateNotFound { return New-OwnerCandidate ` -Candidate "No owner candidate found" ` -CandidateType "NotFound" ` -Confidence "LOW" ` -Relationship "None" ` -Signal "NONE" ` -EvidenceId "not-found" ` -EvidenceSource "ownerCandidates" ` -EvidenceValue "" ` -Reason "No Graph owners, memberships, Azure RBAC co-assignments, resource owner tags, or activity evidence were found." } function Test-OwnerTagNameMatch { param( [string]$TagName, [hashtable]$TagNameSet ) if ([string]::IsNullOrWhiteSpace($TagName) -or -not $TagNameSet) { return $false } return $TagNameSet.ContainsKey($TagName) } function Resolve-OwnerTagCandidateType { param( [string]$TagName, [hashtable]$UserOwnerTagNameSet, [hashtable]$GroupOwnerTagNameSet, [hashtable]$TagOwnerTagNameSet ) if (Test-OwnerTagNameMatch -TagName $TagName -TagNameSet $UserOwnerTagNameSet) { return "User" } if (Test-OwnerTagNameMatch -TagName $TagName -TagNameSet $GroupOwnerTagNameSet) { return "Group" } if (Test-OwnerTagNameMatch -TagName $TagName -TagNameSet $TagOwnerTagNameSet) { return "Tag" } return "" } function Add-OwnerCandidatesFromTags { param( [object[]]$Tags, [string]$Relationship, [hashtable]$Rule, [string]$EvidenceId, [string]$EvidenceSource, [string]$Reason, [hashtable]$UserOwnerTagNameSet, [hashtable]$GroupOwnerTagNameSet, [hashtable]$TagOwnerTagNameSet ) if (-not (Test-OwnerCandidatePolicyEnabled -Rule $Rule)) { return @() } foreach ($tag in @($Tags)) { if ([string]::IsNullOrWhiteSpace([string]$tag.Value)) { continue } $candidateType = Resolve-OwnerTagCandidateType ` -TagName ([string]$tag.Name) ` -UserOwnerTagNameSet $UserOwnerTagNameSet ` -GroupOwnerTagNameSet $GroupOwnerTagNameSet ` -TagOwnerTagNameSet $TagOwnerTagNameSet if ([string]::IsNullOrWhiteSpace($candidateType)) { continue } New-OwnerCandidate ` -Candidate (Format-OwnerTagCandidateValue -TagName ([string]$tag.Name) -TagValue ([string]$tag.Value) -CandidateType $candidateType) ` -CandidateType $candidateType ` -Confidence (ConvertTo-OwnerConfidence -Score (Get-OwnerCandidatePolicyScore -Rule $Rule -CandidateType $candidateType)) ` -Relationship $Relationship ` -Signal ([string]$Rule.Signal) ` -EvidenceId $EvidenceId ` -EvidenceSource $EvidenceSource ` -EvidenceValue ("{0}={1}" -f $tag.Name, [string]$tag.Value) ` -Reason $Reason } } # SIG # Begin signature block # MII9MQYJKoZIhvcNAQcCoII9IjCCPR4CAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDomD94POT0HxhX # JRLaJIH0KGkUzUvOdZ0wpxLWnITajqCCIfYwggXMMIIDtKADAgECAhBUmNLR1FsZ # lUgTecgRwIeZMA0GCSqGSIb3DQEBDAUAMHcxCzAJBgNVBAYTAlVTMR4wHAYDVQQK # ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xSDBGBgNVBAMTP01pY3Jvc29mdCBJZGVu # dGl0eSBWZXJpZmljYXRpb24gUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgMjAy # MDAeFw0yMDA0MTYxODM2MTZaFw00NTA0MTYxODQ0NDBaMHcxCzAJBgNVBAYTAlVT # MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xSDBGBgNVBAMTP01pY3Jv # c29mdCBJZGVudGl0eSBWZXJpZmljYXRpb24gUm9vdCBDZXJ0aWZpY2F0ZSBBdXRo # b3JpdHkgMjAyMDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALORKgeD # Bmf9np3gx8C3pOZCBH8Ppttf+9Va10Wg+3cL8IDzpm1aTXlT2KCGhFdFIMeiVPvH # or+Kx24186IVxC9O40qFlkkN/76Z2BT2vCcH7kKbK/ULkgbk/WkTZaiRcvKYhOuD # PQ7k13ESSCHLDe32R0m3m/nJxxe2hE//uKya13NnSYXjhr03QNAlhtTetcJtYmrV # qXi8LW9J+eVsFBT9FMfTZRY33stuvF4pjf1imxUs1gXmuYkyM6Nix9fWUmcIxC70 # ViueC4fM7Ke0pqrrBc0ZV6U6CwQnHJFnni1iLS8evtrAIMsEGcoz+4m+mOJyoHI1 # vnnhnINv5G0Xb5DzPQCGdTiO0OBJmrvb0/gwytVXiGhNctO/bX9x2P29Da6SZEi3 # W295JrXNm5UhhNHvDzI9e1eM80UHTHzgXhgONXaLbZ7LNnSrBfjgc10yVpRnlyUK # xjU9lJfnwUSLgP3B+PR0GeUw9gb7IVc+BhyLaxWGJ0l7gpPKWeh1R+g/OPTHU3mg # trTiXFHvvV84wRPmeAyVWi7FQFkozA8kwOy6CXcjmTimthzax7ogttc32H83rwjj # O3HbbnMbfZlysOSGM1l0tRYAe1BtxoYT2v3EOYI9JACaYNq6lMAFUSw0rFCZE4e7 # swWAsk0wAly4JoNdtGNz764jlU9gKL431VulAgMBAAGjVDBSMA4GA1UdDwEB/wQE # AwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTIftJqhSobyhmYBAcnz1AQ # T2ioojAQBgkrBgEEAYI3FQEEAwIBADANBgkqhkiG9w0BAQwFAAOCAgEAr2rd5hnn # LZRDGU7L6VCVZKUDkQKL4jaAOxWiUsIWGbZqWl10QzD0m/9gdAmxIR6QFm3FJI9c # Zohj9E/MffISTEAQiwGf2qnIrvKVG8+dBetJPnSgaFvlVixlHIJ+U9pW2UYXeZJF # xBA2CFIpF8svpvJ+1Gkkih6PsHMNzBxKq7Kq7aeRYwFkIqgyuH4yKLNncy2RtNwx # AQv3Rwqm8ddK7VZgxCwIo3tAsLx0J1KH1r6I3TeKiW5niB31yV2g/rarOoDXGpc8 # FzYiQR6sTdWD5jw4vU8w6VSp07YEwzJ2YbuwGMUrGLPAgNW3lbBeUU0i/OxYqujY # lLSlLu2S3ucYfCFX3VVj979tzR/SpncocMfiWzpbCNJbTsgAlrPhgzavhgplXHT2 # 6ux6anSg8Evu75SjrFDyh+3XOjCDyft9V77l4/hByuVkrrOj7FjshZrM77nq81YY # uVxzmq/FdxeDWds3GhhyVKVB0rYjdaNDmuV3fJZ5t0GNv+zcgKCf0Xd1WF81E+Al # GmcLfc4l+gcK5GEh2NQc5QfGNpn0ltDGFf5Ozdeui53bFv0ExpK91IjmqaOqu/dk # ODtfzAzQNb50GQOmxapMomE2gj4d8yu8l13bS3g7LfU772Aj6PXsCyM2la+YZr9T # 03u4aUoqlmZpxJTG9F9urJh4iIAGXKKy7aIwggaoMIIEkKADAgECAhMzAAVPfTUJ # QAZQHopGAAAABU99MA0GCSqGSIb3DQEBDAUAMFoxCzAJBgNVBAYTAlVTMR4wHAYD # VQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKzApBgNVBAMTIk1pY3Jvc29mdCBJ # RCBWZXJpZmllZCBDUyBBT0MgQ0EgMDQwHhcNMjYwODI1MDgwNDExWhcNMjYwODI4 # MDgwNDExWjBpMQswCQYDVQQGEwJQTDEXMBUGA1UECB4OAUEA8wBkAHoAawBpAGUx # DzANBgNVBAcTBldpZWx1bjEXMBUGA1UEChMOc29mdDRwbSBzcCB6b28xFzAVBgNV # BAMTDnNvZnQ0cG0gc3Agem9vMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKC # AYEAocE6bh7BfN0QU54JIUvRPWmy+ysJUci/b3hULZiKuxSXgSEDL84ShpNAGwrh # lV6tPR5vcscj86/4XIFBEska7rrQn8vTXT1jHQs5osShbzpPVYGQ7XZoxZ3UKtjg # t8Qlk9SdprbULZjoAOtC3PJd4nAC8coEpIOcMlorOuqBGvpfoojTOlN6Zg/Jib4x # tbUMvRloe2so7oo27Vy/sXxGiyp1/uOPa+4r3IxB5/WUJ1MQBiql7DDwpUJNd1wV # EftVYiuKDM2NE5l/eGKMIwRwhReCAloZOh6OFkOXSJ6g4hCqWeecT2D6fQvyn8ZZ # pawAgbtLA5urPZejm/mqoTEqTx1KWQW+k8yqiFqLrxVlGtb0SHZxLVvjTd9gSwy4 # oANA6jfb/JJg5g1M3EeKIQPV5jvGIl6yfbOhyTggX1etcvPI4eXEw+f1kmh8TdTU # yHLBbuZ9kMWG2qtVmpqwtHrL2UwBAKo5MhXa3e6ERoVnEcROadONbo27S8WHqo3T # uRFxAgMBAAGjggHWMIIB0jAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIHgDA9 # BgNVHSUENjA0BgorBgEEAYI3YQEABggrBgEFBQcDAwYcKwYBBAGCN2GCycz3dYGA # 0Y0Tg469piSB0sq0aDAdBgNVHQ4EFgQURabqFJmKZYz1eHc7Xhaz0j6pNQ4wHwYD # VR0jBBgwFoAUayVB3vtrfP0YgAotf492XapzPbgwZwYDVR0fBGAwXjBcoFqgWIZW # aHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0JTIw # SUQlMjBWZXJpZmllZCUyMENTJTIwQU9DJTIwQ0ElMjAwNC5jcmwwdAYIKwYBBQUH # AQEEaDBmMGQGCCsGAQUFBzAChlhodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtp # b3BzL2NlcnRzL01pY3Jvc29mdCUyMElEJTIwVmVyaWZpZWQlMjBDUyUyMEFPQyUy # MENBJTIwMDQuY3J0MFQGA1UdIARNMEswSQYEVR0gADBBMD8GCCsGAQUFBwIBFjNo # dHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL0RvY3MvUmVwb3NpdG9yeS5o # dG0wDQYJKoZIhvcNAQEMBQADggIBAA7WN0dZBECI5337xXm8N31AzYt/jteKg705 # rwgWajF4r9oGfz7dvPc6zUYpu6D9ZzkSL4nlGAWXb/vlBn8uh48UltXdZWdwIS34 # mLMUdGr4OMKrpCakWAmvip4pS+KP/DMoFX7L5Fs53gghdFU6Z54OnUDHODPPF44H # Zjq4Z/E0Xu2gVTfvQGBwzq6lNjxCXRR1v+XG1v0s+s9f/qPKAh9VDfPLRnb1w1PF # JuhC9GOpwU0b+8P8F6HdzRLoyiVkPIHEoWVxhQNnqk860hJXMCZ+MneMJCOWpRQO # eTzPVvpyMzXny21kKvNlMg1M/hdlTXoauvBbH0ttDopbSJNKTpqwNDRiLXlLubbv # pKIBSvUJGkjJjGvoK+rEG1C2YUJdNePG01Lm6HffemlVxk41akC6QlzUKZIsIm9F # PcyHWVsmH7yQ2aH5gqKQfhC9Y5w6c5WSQ6bqJAixCMTeNtV0NHleXxRZ5qLI+cfC # fX0zzzXaAkYDmwkmiHuu9CTMsCeTP6Oxi8QPoZinWPgktOnFaMknT5gDLWWzpTuc # b3S1Wt41UhuPLP2Jgi+rID9F4laca10Ir2VOMgS5oz0roDTW5wOWUWQl/+2ISqoE # shl+RwZcyi4L571Akr6hjt4uo7rESFzentjz57qj/5r0asX9mQkcZL7WvmqpePrI # RxtltUE3MIIGqDCCBJCgAwIBAgITMwAFT301CUAGUB6KRgAAAAVPfTANBgkqhkiG # 9w0BAQwFADBaMQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv # cmF0aW9uMSswKQYDVQQDEyJNaWNyb3NvZnQgSUQgVmVyaWZpZWQgQ1MgQU9DIENB # IDA0MB4XDTI2MDgyNTA4MDQxMVoXDTI2MDgyODA4MDQxMVowaTELMAkGA1UEBhMC # UEwxFzAVBgNVBAgeDgFBAPMAZAB6AGsAaQBlMQ8wDQYDVQQHEwZXaWVsdW4xFzAV # BgNVBAoTDnNvZnQ0cG0gc3Agem9vMRcwFQYDVQQDEw5zb2Z0NHBtIHNwIHpvbzCC # AaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKHBOm4ewXzdEFOeCSFL0T1p # svsrCVHIv294VC2YirsUl4EhAy/OEoaTQBsK4ZVerT0eb3LHI/Ov+FyBQRLJGu66 # 0J/L0109Yx0LOaLEoW86T1WBkO12aMWd1CrY4LfEJZPUnaa21C2Y6ADrQtzyXeJw # AvHKBKSDnDJaKzrqgRr6X6KI0zpTemYPyYm+MbW1DL0ZaHtrKO6KNu1cv7F8Rosq # df7jj2vuK9yMQef1lCdTEAYqpeww8KVCTXdcFRH7VWIrigzNjROZf3hijCMEcIUX # ggJaGToejhZDl0ieoOIQqlnnnE9g+n0L8p/GWaWsAIG7SwObqz2Xo5v5qqExKk8d # SlkFvpPMqohai68VZRrW9Eh2cS1b403fYEsMuKADQOo32/ySYOYNTNxHiiED1eY7 # xiJesn2zock4IF9XrXLzyOHlxMPn9ZJofE3U1MhywW7mfZDFhtqrVZqasLR6y9lM # AQCqOTIV2t3uhEaFZxHETmnTjW6Nu0vFh6qN07kRcQIDAQABo4IB1jCCAdIwDAYD # VR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwPQYDVR0lBDYwNAYKKwYBBAGCN2EB # AAYIKwYBBQUHAwMGHCsGAQQBgjdhgsnM93WBgNGNE4OOvaYkgdLKtGgwHQYDVR0O # BBYEFEWm6hSZimWM9Xh3O14Ws9I+qTUOMB8GA1UdIwQYMBaAFGslQd77a3z9GIAK # LX+Pdl2qcz24MGcGA1UdHwRgMF4wXKBaoFiGVmh0dHA6Ly93d3cubWljcm9zb2Z0 # LmNvbS9wa2lvcHMvY3JsL01pY3Jvc29mdCUyMElEJTIwVmVyaWZpZWQlMjBDUyUy # MEFPQyUyMENBJTIwMDQuY3JsMHQGCCsGAQUFBwEBBGgwZjBkBggrBgEFBQcwAoZY # aHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jZXJ0cy9NaWNyb3NvZnQl # MjBJRCUyMFZlcmlmaWVkJTIwQ1MlMjBBT0MlMjBDQSUyMDA0LmNydDBUBgNVHSAE # TTBLMEkGBFUdIAAwQTA/BggrBgEFBQcCARYzaHR0cDovL3d3dy5taWNyb3NvZnQu # Y29tL3BraW9wcy9Eb2NzL1JlcG9zaXRvcnkuaHRtMA0GCSqGSIb3DQEBDAUAA4IC # AQAO1jdHWQRAiOd9+8V5vDd9QM2Lf47XioO9Oa8IFmoxeK/aBn8+3bz3Os1GKbug # /Wc5Ei+J5RgFl2/75QZ/LoePFJbV3WVncCEt+JizFHRq+DjCq6QmpFgJr4qeKUvi # j/wzKBV+y+RbOd4IIXRVOmeeDp1AxzgzzxeOB2Y6uGfxNF7toFU370BgcM6upTY8 # Ql0Udb/lxtb9LPrPX/6jygIfVQ3zy0Z29cNTxSboQvRjqcFNG/vD/Beh3c0S6Mol # ZDyBxKFlcYUDZ6pPOtISVzAmfjJ3jCQjlqUUDnk8z1b6cjM158ttZCrzZTINTP4X # ZU16GrrwWx9LbQ6KW0iTSk6asDQ0Yi15S7m276SiAUr1CRpIyYxr6CvqxBtQtmFC # XTXjxtNS5uh333ppVcZONWpAukJc1CmSLCJvRT3Mh1lbJh+8kNmh+YKikH4QvWOc # OnOVkkOm6iQIsQjE3jbVdDR5Xl8UWeaiyPnHwn19M8812gJGA5sJJoh7rvQkzLAn # kz+jsYvED6GYp1j4JLTpxWjJJ0+YAy1ls6U7nG90tVreNVIbjyz9iYIvqyA/ReJW # nGtdCK9lTjIEuaM9K6A01ucDllFkJf/tiEqqBLIZfkcGXMouC+e9QJK+oY7eLqO6 # xEhc3p7Y8+e6o/+a9GrF/ZkJHGS+1r5qqXj6yEcbZbVBNzCCBygwggUQoAMCAQIC # EzMAAAAWMZKNkgJle5oAAAAAABYwDQYJKoZIhvcNAQEMBQAwYzELMAkGA1UEBhMC # VVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjE0MDIGA1UEAxMrTWlj # cm9zb2Z0IElEIFZlcmlmaWVkIENvZGUgU2lnbmluZyBQQ0EgMjAyMTAeFw0yNjAz # MjYxODExMjlaFw0zMTAzMjYxODExMjlaMFoxCzAJBgNVBAYTAlVTMR4wHAYDVQQK # ExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKzApBgNVBAMTIk1pY3Jvc29mdCBJRCBW # ZXJpZmllZCBDUyBBT0MgQ0EgMDQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIK # AoICAQDKVfrI2+gJMM/0bQ5OVKNdvOASzLbUUMvXuf+Vl7YGuofPaZHVo3gMHF5i # nT+GMSpIcfIZ9qtXU1UG68ry8vNbQtOL4Nm30ifXpqI1+ByiAWLO1YT0WnzG7XPO # uoTeeWsNZv5FmjxCsReBZvyzyzCyXZbu1EQfJxWTH4ebUwtAiW9rqMf9eDj/wYhi # EfNteJV3ZFeibD2ztCHr9JhFdd97XbnCHgQoTIqc02X5xlRKtUGBa++OtHBBjiJ/ # uwBnzTkqu4FjpZjQeJtrmda+ur1CT2jflWIB/ypn7u7V9tvW9wJbJYt/H2EtJ0GO # NWxJZ7TEu8jWPindOO3lzPP7UtzS/mVDV94HucWaltmsra6zSG8BoEJ87IM8QSb7 # vfm/O41FhYkUv89WIj5ES2O4kxyiMSfe95CMivCuYrRP2hKvx7egPMrWgDDBkxML # grKZO9hRNUMm8vk3w5b9SogHOyJVhxyFm8aFXfIxgqDF4S0g4bhbhnzljmSlCLlu # mMZcXFGDjpF2tNoAu3VGFGYtHtTSNVKvZpgB3b4ynaoDkbPf+Wg4523jt4VneasB # gZhC1srZI2NCnCBBfgjLq04pqEKAWEohyW2K29KSkkHvt5VaE1ac3Yt+oyiOzMS5 # 7tXwQDJLGvLg/OXFO0VNvczDndfIfXYExB/ab2PuMSwd5VIBOwIDAQABo4IB3DCC # AdgwDgYDVR0PAQH/BAQDAgGGMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRr # JUHe+2t8/RiACi1/j3ZdqnM9uDBUBgNVHSAETTBLMEkGBFUdIAAwQTA/BggrBgEF # BQcCARYzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9Eb2NzL1JlcG9z # aXRvcnkuaHRtMBkGCSsGAQQBgjcUAgQMHgoAUwB1AGIAQwBBMBIGA1UdEwEB/wQI # MAYBAf8CAQAwHwYDVR0jBBgwFoAU2UEpsA8PY2zvadf1zSmepEhqMOYwcAYDVR0f # BGkwZzBloGOgYYZfaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwv # TWljcm9zb2Z0JTIwSUQlMjBWZXJpZmllZCUyMENvZGUlMjBTaWduaW5nJTIwUENB # JTIwMjAyMS5jcmwwfQYIKwYBBQUHAQEEcTBvMG0GCCsGAQUFBzAChmFodHRwOi8v # d3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01pY3Jvc29mdCUyMElEJTIw # VmVyaWZpZWQlMjBDb2RlJTIwU2lnbmluZyUyMFBDQSUyMDIwMjEuY3J0MA0GCSqG # SIb3DQEBDAUAA4ICAQAG1VBeVHTVRBljlcZD3IiMxwPyMjQyLNaEnVu5mODm2hRB # JfH8GsBLATmrHAc8F47jmk5CnpUPiIguCbw6Z/KVj4Dsoiq228NSLMLewFfGMri7 # uwNGLISC5ccp8vUdADDEIsS2dE+QI9OwkDpv3XuUD7d+hAgcLVcMOl1AsfEZtsZe # nhGvSYUrm/FuLq0BqEGL9GXM5c+Ho9q8o+Vn/S+GWQN2y+gkRO15s0kI05nUpq/d # OD4ri9rgVs6tipEd0YZqGgD+CZNiaZWrDTOQbNPncd2F9qOsUa20miYruoT5PwJA # aI+QQiTE2ZJeMJOkOpzhTUgqVMZwZidEUZKCqudaeQA08WwnkQMfKyHzaU8j48UL # cU4hUwvMsv7fSurOe9GAdRQCPvF8WcSK5oDHe8VVJM4tv6KKCm91HqLx9JamBgRI # 6R2SfY3nu26EGznu0rCg/769z8xWm4PVcC2ZaL6VlKVqFp1NsN8YqMyf5t+bbGVb # 09noFKcJG/UwyGlxRmQBlfeBUQx5/ytlzZzsEnhrJF9fTAfje8j3OdX5lEnePTFQ # LRlvzZFBqUXnIeQKv3fHQjC9m2fo/Z01DII/qp3d8LhGVUW0BCG04fRwHJNH8iqq # CG/qofMv+kym2AxBDnHzNgRjL60JOFiBgiurvLhYQNhB95KWojFA6shQnggkMTCC # B54wggWGoAMCAQICEzMAAAAHh6M0o3uljhwAAAAAAAcwDQYJKoZIhvcNAQEMBQAw # dzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjFI # MEYGA1UEAxM/TWljcm9zb2Z0IElkZW50aXR5IFZlcmlmaWNhdGlvbiBSb290IENl # cnRpZmljYXRlIEF1dGhvcml0eSAyMDIwMB4XDTIxMDQwMTIwMDUyMFoXDTM2MDQw # MTIwMTUyMFowYzELMAkGA1UEBhMCVVMxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jw # b3JhdGlvbjE0MDIGA1UEAxMrTWljcm9zb2Z0IElEIFZlcmlmaWVkIENvZGUgU2ln # bmluZyBQQ0EgMjAyMTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBALLw # wK8ZiCji3VR6TElsaQhVCbRS/3pK+MHrJSj3Zxd3KU3rlfL3qrZilYKJNqztA9OQ # acr1AwoNcHbKBLbsQAhBnIB34zxf52bDpIO3NJlfIaTE/xrweLoQ71lzCHkD7A4A # s1Bs076Iu+mA6cQzsYYH/Cbl1icwQ6C65rU4V9NQhNUwgrx9rGQ//h890Q8JdjLL # w0nV+ayQ2Fbkd242o9kH82RZsH3HEyqjAB5a8+Ae2nPIPc8sZU6ZE7iRrRZywRmr # KDp5+TcmJX9MRff241UaOBs4NmHOyke8oU1TYrkxh+YeHgfWo5tTgkoSMoayqoDp # HOLJs+qG8Tvh8SnifW2Jj3+ii11TS8/FGngEaNAWrbyfNrC69oKpRQXY9bGH6jn9 # NEJv9weFxhTwyvx9OJLXmRGbAUXN1U9nf4lXezky6Uh/cgjkVd6CGUAf0K+Jw+GE # /5VpIVbcNr9rNE50Sbmy/4RTCEGvOq3GhjITbCa4crCzTTHgYYjHs1NbOc6brH+e # KpWLtr+bGecy9CrwQyx7S/BfYJ+ozst7+yZtG2wR461uckFu0t+gCwLdN0A6cFtS # RtR8bvxVFyWwTtgMMFRuBa3vmUOTnfKLsLefRaQcVTgRnzeLzdpt32cdYKp+dhr2 # ogc+qM6K4CBI5/j4VFyC4QFeUP2YAidLtvpXRRo3AgMBAAGjggI1MIICMTAOBgNV # HQ8BAf8EBAMCAYYwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFNlBKbAPD2Ns # 72nX9c0pnqRIajDmMFQGA1UdIARNMEswSQYEVR0gADBBMD8GCCsGAQUFBwIBFjNo # dHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL0RvY3MvUmVwb3NpdG9yeS5o # dG0wGQYJKwYBBAGCNxQCBAweCgBTAHUAYgBDAEEwDwYDVR0TAQH/BAUwAwEB/zAf # BgNVHSMEGDAWgBTIftJqhSobyhmYBAcnz1AQT2ioojCBhAYDVR0fBH0wezB5oHeg # dYZzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jcmwvTWljcm9zb2Z0 # JTIwSWRlbnRpdHklMjBWZXJpZmljYXRpb24lMjBSb290JTIwQ2VydGlmaWNhdGUl # MjBBdXRob3JpdHklMjAyMDIwLmNybDCBwwYIKwYBBQUHAQEEgbYwgbMwgYEGCCsG # AQUFBzAChnVodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01p # Y3Jvc29mdCUyMElkZW50aXR5JTIwVmVyaWZpY2F0aW9uJTIwUm9vdCUyMENlcnRp # ZmljYXRlJTIwQXV0aG9yaXR5JTIwMjAyMC5jcnQwLQYIKwYBBQUHMAGGIWh0dHA6 # Ly9vbmVvY3NwLm1pY3Jvc29mdC5jb20vb2NzcDANBgkqhkiG9w0BAQwFAAOCAgEA # fyUqnv7Uq+rdZgrbVyNMul5skONbhls5fccPlmIbzi+OwVdPQ4H55v7VOInnmezQ # EeW4LqK0wja+fBznANbXLB0KrdMCbHQpbLvG6UA/Xv2pfpVIE1CRFfNF4XKO8XYE # a3oW8oVH+KZHgIQRIwAbyFKQ9iyj4aOWeAzwk+f9E5StNp5T8FG7/VEURIVWArbA # zPt9ThVN3w1fAZkF7+YU9kbq1bCR2YD+MtunSQ1Rft6XG7b4e0ejRA7mB2IoX5hN # h3UEauY0byxNRG+fT2MCEhQl9g2i2fs6VOG19CNep7SquKaBjhWmirYyANb0RJSL # WjinMLXNOAga10n8i9jqeprzSMU5ODmrMCJE12xS/NWShg/tuLjAsKP6SzYZ+1Ry # 358ZTFcx0FS/mx2vSoU8s8HRvy+rnXqyUJ9HBqS0DErVLjQwK8VtsBdekBmdTbQV # oCgPCqr+PDPB3xajYnzevs7eidBsM71PINK2BoE2UfMwxCCX3mccFgx6UsQeRSdV # VVNSyALQe6PT12418xon2iDGE81OGCreLzDcMAZnrUAx4XQLUz6ZTl65yPUiOh3k # 7Yww94lDf+8oG2oZmDh5O1Qe38E+M3vhKwmzIeoB1dVLlz4i3IpaDcR+iuGjH2Td # aC1ZOmBXiCRKJLj4DT2uhJ04ji+tHD6n58vhavFIrmcxghqRMIIajQIBATBxMFox # CzAJBgNVBAYTAlVTMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKzAp # BgNVBAMTIk1pY3Jvc29mdCBJRCBWZXJpZmllZCBDUyBBT0MgQ0EgMDQCEzMABU99 # NQlABlAeikYAAAAFT30wDQYJYIZIAWUDBAIBBQCgXjAQBgorBgEEAYI3AgEMMQIw # ADAZBgkqhkiG9w0BCQMxDAYKKwYBBAGCNwIBBDAvBgkqhkiG9w0BCQQxIgQgl0CT # cTTApTw/+G5mr2TX/U3g++UGFXjCD7bGvcjzXt8wDQYJKoZIhvcNAQEBBQAEggGA # Ujz2P2hONeNrhhBhRUGV+xCFB6VfBtm0F9TtZR85+qnSeRhGx0HBb3la7eTtNZ7d # UIy5l3zC1WOewKWk4hg077QRnbB3RNrGym5hWsE2euQI0VTddHkJgsmY6WX3S910 # VXYUpk0T6M80Y7WUB+L8Tm3er99n5xCmcbFMQl3PP8sGEwNJURqLy7PKrkyZChib # PdVjSRxqMMi2pOd3qZSTdQGhLnskhDuHt70ZNrBjyjgvTzvEcu/f33oP90s6l05d # QXo3NRtrHesXDAIXe2or9SfaN7kdUEsv4g2xEORGdp+O/4SoLKmeJikIbnAuNiV/ # YH77DSO9+fNPbBeY6i+5K4T1sHi3fhC/EdHzuOgyBm96m3GEzcn6UAvgJyoVZH3C # cnPE212bJ9rqZMiFb2oDNXtsslHHCA+q7iPjszQE6cUptZvkdIK4htODJd48vZI0 # 9FBbnQ6jEg2f7HZ4vaeTexszMXtgw6gIxJ+OHmqKjTmfVUDX6VpsKLEoew2l7nak # oYIYETCCGA0GCisGAQQBgjcDAwExghf9MIIX+QYJKoZIhvcNAQcCoIIX6jCCF+YC # AQMxDzANBglghkgBZQMEAgEFADCCAWIGCyqGSIb3DQEJEAEEoIIBUQSCAU0wggFJ # AgEBBgorBgEEAYRZCgMBMDEwDQYJYIZIAWUDBAIBBQAEIMSBPUHPzG27MXw1VsRf # 3UkuZKiMzAXE31jfi82E14NIAgZqhEjomGYYEzIwMjYwODI2MTIxMDEwLjA4M1ow # BIACAfSggeGkgd4wgdsxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9u # MRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRp # b24xJTAjBgNVBAsTHE1pY3Jvc29mdCBBbWVyaWNhIE9wZXJhdGlvbnMxJzAlBgNV # BAsTHm5TaGllbGQgVFNTIEVTTjpBNTAwLTA1RTAtRDk0NzE1MDMGA1UEAxMsTWlj # cm9zb2Z0IFB1YmxpYyBSU0EgVGltZSBTdGFtcGluZyBBdXRob3JpdHmggg8hMIIH # gjCCBWqgAwIBAgITMwAAAAXlzw//Zi7JhwAAAAAABTANBgkqhkiG9w0BAQwFADB3 # MQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMUgw # RgYDVQQDEz9NaWNyb3NvZnQgSWRlbnRpdHkgVmVyaWZpY2F0aW9uIFJvb3QgQ2Vy # dGlmaWNhdGUgQXV0aG9yaXR5IDIwMjAwHhcNMjAxMTE5MjAzMjMxWhcNMzUxMTE5 # MjA0MjMxWjBhMQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBv # cmF0aW9uMTIwMAYDVQQDEylNaWNyb3NvZnQgUHVibGljIFJTQSBUaW1lc3RhbXBp # bmcgQ0EgMjAyMDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAJ5851Jj # /eDFnwV9Y7UGIqMcHtfnlzPREwW9ZUZHd5HBXXBvf7KrQ5cMSqFSHGqg2/qJhYqO # QxwuEQXG8kB41wsDJP5d0zmLYKAY8Zxv3lYkuLDsfMuIEqvGYOPURAH+Ybl4SJEE # Snt0MbPEoKdNihwM5xGv0rGofJ1qOYSTNcc55EbBT7uq3wx3mXhtVmtcCEr5ZKTk # KKE1CxZvNPWdGWJUPC6e4uRfWHIhZcgCsJ+sozf5EeH5KrlFnxpjKKTavwfFP6Xa # GZGWUG8TZaiTogRoAlqcevbiqioUz1Yt4FRK53P6ovnUfANjIgM9JDdJ4e0qiDRm # 5sOTiEQtBLGd9Vhd1MadxoGcHrRCsS5rO9yhv2fjJHrmlQ0EIXmp4DhDBieKUGR+ # eZ4CNE3ctW4uvSDQVeSp9h1SaPV8UWEfyTxgGjOsRpeexIveR1MPTVf7gt8hY64X # NPO6iyUGsEgt8c2PxF87E+CO7A28TpjNq5eLiiunhKbq0XbjkNoU5JhtYUrlmAbp # xRjb9tSreDdtACpm3rkpxp7AQndnI0Shu/fk1/rE3oWsDqMX3jjv40e8KN5YsJBn # czyWB4JyeeFMW3JBfdeAKhzohFe8U5w9WuvcP1E8cIxLoKSDzCCBOu0hWdjzKNu8 # Y5SwB1lt5dQhABYyzR3dxEO/T1K/BVF3rV69AgMBAAGjggIbMIICFzAOBgNVHQ8B # Af8EBAMCAYYwEAYJKwYBBAGCNxUBBAMCAQAwHQYDVR0OBBYEFGtpKDo1L0hjQM97 # 2K9J6T7ZPdshMFQGA1UdIARNMEswSQYEVR0gADBBMD8GCCsGAQUFBwIBFjNodHRw # Oi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL0RvY3MvUmVwb3NpdG9yeS5odG0w # EwYDVR0lBAwwCgYIKwYBBQUHAwgwGQYJKwYBBAGCNxQCBAweCgBTAHUAYgBDAEEw # DwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTIftJqhSobyhmYBAcnz1AQT2io # ojCBhAYDVR0fBH0wezB5oHegdYZzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3Br # aW9wcy9jcmwvTWljcm9zb2Z0JTIwSWRlbnRpdHklMjBWZXJpZmljYXRpb24lMjBS # b290JTIwQ2VydGlmaWNhdGUlMjBBdXRob3JpdHklMjAyMDIwLmNybDCBlAYIKwYB # BQUHAQEEgYcwgYQwgYEGCCsGAQUFBzAChnVodHRwOi8vd3d3Lm1pY3Jvc29mdC5j # b20vcGtpb3BzL2NlcnRzL01pY3Jvc29mdCUyMElkZW50aXR5JTIwVmVyaWZpY2F0 # aW9uJTIwUm9vdCUyMENlcnRpZmljYXRlJTIwQXV0aG9yaXR5JTIwMjAyMC5jcnQw # DQYJKoZIhvcNAQEMBQADggIBAF+Idsd+bbVaFXXnTHho+k7h2ESZJRWluLE0Oa/p # O+4ge/XEizXvhs0Y7+KVYyb4nHlugBesnFqBGEdC2IWmtKMyS1OWIviwpnK3aL5J # edwzbeBF7POyg6IGG/XhhJ3UqWeWTO+Czb1c2NP5zyEh89F72u9UIw+IfvM9lzDm # c2O2END7MPnrcjWdQnrLn1Ntday7JSyrDvBdmgbNnCKNZPmhzoa8PccOiQljjTW6 # GePe5sGFuRHzdFt8y+bN2neF7Zu8hTO1I64XNGqst8S+w+RUdie8fXC1jKu3m9KG # IqF4aldrYBamyh3g4nJPj/LR2CBaLyD+2BuGZCVmoNR/dSpRCxlot0i79dKOChmo # ONqbMI8m04uLaEHAv4qwKHQ1vBzbV/nG89LDKbRSSvijmwJwxRxLLpMQ/u4xXxFf # R4f/gksSkbJp7oqLwliDm/h+w0aJ/U5ccnYhYb7vPKNMN+SZDWycU5ODIRfyoGl5 # 9BsXR/HpRGtiJquOYGmvA/pk5vC1lcnbeMrcWD/26ozePQ/TWfNXKBOmkFpvPE8C # H+EeGGWzqTCjdAsno2jzTeNSxlx3glDGJgcdz5D/AAxw9Sdgq/+rY7jjgs7X6fqP # TXPmaCAJKVHAP19oEjJIBwD1LyHbaEgBxFCogYSOiUIr0Xqcr1nJfiWG2GwYe6Zo # AF1bMIIHlzCCBX+gAwIBAgITMwAAAFZ+j51YCI7pYAAAAAAAVjANBgkqhkiG9w0B # AQwFADBhMQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0 # aW9uMTIwMAYDVQQDEylNaWNyb3NvZnQgUHVibGljIFJTQSBUaW1lc3RhbXBpbmcg # Q0EgMjAyMDAeFw0yNTEwMjMyMDQ2NTFaFw0yNjEwMjIyMDQ2NTFaMIHbMQswCQYD # VQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEe # MBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3Nv # ZnQgQW1lcmljYSBPcGVyYXRpb25zMScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046 # QTUwMC0wNUUwLUQ5NDcxNTAzBgNVBAMTLE1pY3Jvc29mdCBQdWJsaWMgUlNBIFRp # bWUgU3RhbXBpbmcgQXV0aG9yaXR5MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC # CgKCAgEAtKWfm/ul027/d8Rlb8Mn/g0QUvvLqY2Vsy3tI8U2tFSspTZomZOD3BHT # 8LkR+RrhMJgb1VjAKFNysaK9cLSXifPGSIBrPCgs9P4y24lrJEmrV6Q5z4BmqMhI # PrZhEvZnWpCS4HO7jYSei/nxmC7/1Er+l5Lg3PmSxb8d2IVcARxSw1B4mxB6XI0n # kel9wa1dYb2wfGpofraFmxZOxT9eNht4LH0RBSVueba6ZNpjS/0gtfm7qiIiyP6p # 6PRzTTbMnVqsHnV/d/rW0zHx+Q+QNZ5wUqKmTZJB9hU853+2pX5rDfK32uNY9/WB # OAmzbqgpEdQkbiMavUMyUDShmycIvgHdQnS207sTj8M+kJL3tOdahPuPqMwsaCCg # dfwwQx0O9TKe7FSvbAEYs1AnldCl/KHGZCOVvUNqjyL10JLe0/+GD9/ynqXGWFpX # OjaunvZ/cKROhjN4M5e6xx0b2miqcPii4/ii2ZheKallJET7CKlpFShs3wyg6F/f # ojQxQvPnbWD4Nyx6lhjWjwmoLcx6w1FSCtavLCly33BLRSlTU4qKUxaa8d7YN7Eq # pn9XO0SY0umOvKFXrWH7rxl+9iaicitdnTTksAnRjvekdKT3lg7lRMfmfZU8vXNi # N0UYJzT9EjqjRm0uN/h0oXxPhNfPYqeFbyPXGGxzaYUz6zx3qTcCAwEAAaOCAcsw # ggHHMB0GA1UdDgQWBBS+tjPyu6tZ/h5GsyLvyz1H+FNIWjAfBgNVHSMEGDAWgBRr # aSg6NS9IY0DPe9ivSek+2T3bITBsBgNVHR8EZTBjMGGgX6BdhltodHRwOi8vd3d3 # Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNyb3NvZnQlMjBQdWJsaWMlMjBS # U0ElMjBUaW1lc3RhbXBpbmclMjBDQSUyMDIwMjAuY3JsMHkGCCsGAQUFBwEBBG0w # azBpBggrBgEFBQcwAoZdaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9j # ZXJ0cy9NaWNyb3NvZnQlMjBQdWJsaWMlMjBSU0ElMjBUaW1lc3RhbXBpbmclMjBD # QSUyMDIwMjAuY3J0MAwGA1UdEwEB/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUH # AwgwDgYDVR0PAQH/BAQDAgeAMGYGA1UdIARfMF0wUQYMKwYBBAGCN0yDfQEBMEEw # PwYIKwYBBQUHAgEWM2h0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvRG9j # cy9SZXBvc2l0b3J5Lmh0bTAIBgZngQwBBAIwDQYJKoZIhvcNAQEMBQADggIBAA4D # qAXEsO26j/La7Fgn/Qifit8xuZekqZ57+Ye+sH/hRTbEEjGYrZgsqwR/lUUfKCFp # bZF8msaZPQJOR4YYUEU8XyjLrn8Y1jCSmoxh9l7tWiSoc/JFBw356JAmzGGxeBA2 # EWSxRuTr1AuZe6nYaN8/wtFkiHcs8gMadxXBs6DxVhyu5YnhLPQkfumKm3lFftwE # 7pieV7f1lskmlgsC6AeSGCzGPZUgCvcH5Tv/Qe9z7bIImSD3SuzhOIwaP+eKQTYf # 67TifyJKkWQSdGfTA6Kcu41k8LB6oPK+MLk1jbxxK5wPqLSL62xjK04SBXHEJSEn # sFt0zxWkxP/lgej1DxqUnmrYEdkxvzKSHIAqFWSZul/5hI+vJxvFPhsNQBEk4cSu # lDkJQpcdVi/gmf/mHFOYhDBjsa15s4L+2sBil3XV/T8RiR66Q8xYvTLRWxd2dVsr # OoCwnsU4WIeiC0JinCv1WLHEh7Qyzr9RSr4kKJLWdpNYLhgjkojTmEkAjFO774t3 # xB7enbvIF0GOsV19xnCUzq9EGKyt0gMuaphKlNjJ+aTpjWMZDGo+GOKsnp93Hmft # ml0Syp3F9+M3y+y6WJGUZoIZJq227jDjjEndtpUrh9BdPdVIfVJD/Au81Rzh05UH # AivorQ3Os8PELHIgiOd9TWzbdgmGzcILt/ddVQERMYIHQzCCBz8CAQEweDBhMQsw # CQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTIwMAYD # VQQDEylNaWNyb3NvZnQgUHVibGljIFJTQSBUaW1lc3RhbXBpbmcgQ0EgMjAyMAIT # MwAAAFZ+j51YCI7pYAAAAAAAVjANBglghkgBZQMEAgEFAKCCBJwwEQYLKoZIhvcN # AQkQAg8xAgUAMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAcBgkqhkiG9w0B # CQUxDxcNMjYwODI2MTIxMDEwWjAvBgkqhkiG9w0BCQQxIgQgoTfBpjjPHkpWiATs # LtZStlAxnVa/h0Rz0Vv+G+l9rhQwgbkGCyqGSIb3DQEJEAIvMYGpMIGmMIGjMIGg # BCC2DDMlTaTj8JV3iTg5Xnpe4CSH60143Z+X9o5NBgMMqDB8MGWkYzBhMQswCQYD # VQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTIwMAYDVQQD # EylNaWNyb3NvZnQgUHVibGljIFJTQSBUaW1lc3RhbXBpbmcgQ0EgMjAyMAITMwAA # AFZ+j51YCI7pYAAAAAAAVjCCA14GCyqGSIb3DQEJEAISMYIDTTCCA0mhggNFMIID # QTCCAikCAQEwggEJoYHhpIHeMIHbMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2Fz # aGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENv # cnBvcmF0aW9uMSUwIwYDVQQLExxNaWNyb3NvZnQgQW1lcmljYSBPcGVyYXRpb25z # MScwJQYDVQQLEx5uU2hpZWxkIFRTUyBFU046QTUwMC0wNUUwLUQ5NDcxNTAzBgNV # BAMTLE1pY3Jvc29mdCBQdWJsaWMgUlNBIFRpbWUgU3RhbXBpbmcgQXV0aG9yaXR5 # oiMKAQEwBwYFKw4DAhoDFQD/c/cpFSqQWYBeXggyRJ2ZbvYEEaBnMGWkYzBhMQsw # CQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTIwMAYD # VQQDEylNaWNyb3NvZnQgUHVibGljIFJTQSBUaW1lc3RhbXBpbmcgQ0EgMjAyMDAN # BgkqhkiG9w0BAQsFAAIFAO45U10wIhgPMjAyNjA4MjYxMTU4MjFaGA8yMDI2MDgy # NzExNTgyMVowdDA6BgorBgEEAYRZCgQBMSwwKjAKAgUA7jlTXQIBADAHAgEAAgIM # OjAHAgEAAgIStTAKAgUA7jqk3QIBADA2BgorBgEEAYRZCgQCMSgwJjAMBgorBgEE # AYRZCgMCoAowCAIBAAIDB6EgoQowCAIBAAIDAYagMA0GCSqGSIb3DQEBCwUAA4IB # AQB8bMeUpRCI4a5FzV0NYWiV0sDJ7ZBgqjRAFUxO9fm/4kPinvDybKIXV9wFICt/ # pW2CJS8KXuQwcX6uK9H/mnmLLan0cNg7wY/PYZdrQ2ghT/eyGsORbXIXJUhQaB3T # xKTMMHdD4F8Imgrz/pL4LzA5sNXNXmSZmajGnvcJu2W44gFWCZkZds7SWyiAzOKj # 9lSaGylMojVa6ZtW9cH1vCsPdw+/+Uy+QxcOtw0NVZxtYYl4Dvy0uXR5OPTUxzIK # TxA3+XjH0/In9TXoyV22PwV8VmthSK+DM0D8aopETh6IPKqJtqof7OHPIPmpj2lI # SaPaXEzRYN/fkUA9wnhfHF3AMA0GCSqGSIb3DQEBAQUABIICAFfQJkVg1mj8kk7c # KLRHY++kB3RqDLt8EnBg1msbONUMn9s0NffF9YzHTsJgGZEYLBvIW3U17q+RGFp/ # 6g87K4C1EZcI6h2N7h2ixDvbV5XdV/vFmyT5NG7HBxPqK0pg4WrH8Hja2KcibXl9 # VXtJ9M7NNhTyylE0R6LO8xOWbgxUGQ9agnBjdSJQG/14rMo6dYf/AwNa60+ry04K # vEpPRca/oXoDT/mEOozRMoK3/JLr+LFzGR/WFfBJhCvWm3cyjPhkorLpbVeyIrnR # XJycZPId/3huxyCb43qJ13r8g+dBbUDQDr5qJ9VSe0mvPvuEDaSpToEPCxfSlplM # tmZCC//BIy8SNuNY866AJmQd4bOkFMQtDylBXpnalfgJMxmuDVt8XaEg4aLCq0U1 # r4RRc2N7OH6fjDSlAihpV8uK5jNji+LkIXT5uGWDH1NkanOpuRzI5+uyB0TOPV/T # aAkGichkXlJCUXz3YLV7I+EuD+I3PB0cNCi5H7EPEIAcibdGNXaJcOimhKi13tc7 # 62j3LPuyjIJmgWq29LIZBUc5vSEJmtmo7gO/Q+gYv88B39S7gxxy9Jn1KPtOhNx6 # znHMsCqh9/5fEvyKZY12C1wDDOGszzUlhDS07aB8HSCw/6tWg4FAVv9SwrnQjCFR # OrpGuBxp7GQS21OGuBms7lrK5sZf # SIG # End signature block |