ScubaGear

1.3.0

Modules/Providers/ExportEXOProvider.psm1

                                function Export-EXOProvider {

    <#

    .Description

    Gets the Exchange Online (EXO) settings that are relevant

    to the SCuBA EXO baselines using the EXO PowerShell Module

    .Functionality

    Internal

    #>

    [CmdletBinding()]

    [OutputType([String])]

    param()

    # Manually importing the module name here to bypass cmdlet name conflicts

    # There are conflicting PowerShell Cmdlet names in EXO and Power Platform

    Import-Module ExchangeOnlineManagement

    Import-Module $PSScriptRoot/ProviderHelpers/CommandTracker.psm1

    $Tracker = Get-CommandTracker

    <#

    MS.EXO.1.1v1

    #>

    $RemoteDomains = ConvertTo-Json @($Tracker.TryCommand("Get-RemoteDomain"))

    <#

    MS.EXO.2.1v1 SPF

    #>

    $domains = $Tracker.TryCommand("Get-AcceptedDomain")

    $SPFRecords = ConvertTo-Json @($Tracker.TryCommand("Get-ScubaSpfRecord", @{"Domains"=$domains})) -Depth 3

    <#

    MS.EXO.3.1v1 DKIM

    #>

    $DKIMConfig = ConvertTo-Json @($Tracker.TryCommand("Get-DkimSigningConfig"))

    $DKIMRecords = ConvertTo-Json @($Tracker.TryCommand("Get-ScubaDkimRecord", @{"Domains"=$domains})) -Depth 3

    <#

    MS.EXO.4.1v1 DMARC

    #>

    $DMARCRecords = ConvertTo-Json @($Tracker.TryCommand("Get-ScubaDmarcRecord", @{"Domains"=$domains})) -Depth 3

    <#

    MS.EXO.5.1v1

    #>

    $TransportConfig = ConvertTo-Json @($Tracker.TryCommand("Get-TransportConfig"))

    <#

    MS.EXO.6.1v1

    #>

    $SharingPolicy = ConvertTo-Json @($Tracker.TryCommand("Get-SharingPolicy"))

    <#

    MS.EXO.7.1v1

    #>

    $TransportRules = ConvertTo-Json @($Tracker.TryCommand("Get-TransportRule"))

    <#

    MS.EXO.12.1v1

    #>

    $ConnectionFilter = ConvertTo-Json @($Tracker.TryCommand("Get-HostedConnectionFilterPolicy"))

    <#

    MS.EXO.13.1v1

    #>

    $Config = $Tracker.TryCommand("Get-OrganizationConfig") | Select-Object Name, DisplayName, AuditDisabled

    $Config = ConvertTo-Json @($Config)

    # Used in the reporter to check successful cmdlet invocation

    $SuccessfulCommands = ConvertTo-Json @($Tracker.GetSuccessfulCommands())

    $UnSuccessfulCommands = ConvertTo-Json @($Tracker.GetUnSuccessfulCommands())

    # Note the spacing and the last comma in the json is important

    $json = @"

    "remote_domains": $RemoteDomains,

    "spf_records": $SPFRecords,

    "dkim_config": $DKIMConfig,

    "dkim_records": $DKIMRecords,

    "dmarc_records": $DMARCRecords,

    "transport_config": $TransportConfig,

    "sharing_policy": $SharingPolicy,

    "transport_rule": $TransportRules,

    "conn_filter": $ConnectionFilter,

    "org_config": $Config,

    "exo_successful_commands": $SuccessfulCommands,

    "exo_unsuccessful_commands": $UnSuccessfulCommands,

"@

    $json

}

function Get-EXOTenantDetail {

    <#

    .Description

    Gets the tenant details using the EXO PowerShell Module

    .Functionality

    Internal

    #>

    [CmdletBinding()]

    param (

        [Parameter(Mandatory = $true)]

        [ValidateSet("commercial", "gcc", "gcchigh", "dod", IgnoreCase = $false)]

        [ValidateNotNullOrEmpty()]

        [string]

        $M365Environment

    )

    try {

        Import-Module ExchangeOnlineManagement

        $OrgConfig = Get-OrganizationConfig -ErrorAction "Stop"

        $DomainName = $OrgConfig.Name

        $TenantId = "Error retrieving Tenant ID"

        $Uri = "https://login.microsoftonline.com/$($DomainName)/.well-known/openid-configuration"

        if (($M365Environment -eq "gcchigh") -or ($M365Environment -eq "dod")) {

            $TLD = ".us"

            $Uri = "https://login.microsoftonline$($TLD)/$($DomainName)/.well-known/openid-configuration"

        }

        try {

            $Content = (Invoke-WebRequest -Uri $Uri -UseBasicParsing -ErrorAction "Stop").Content

            $TenantId = (ConvertFrom-Json $Content).token_endpoint.Split("/")[3]

        }

        catch {

            Write-Warning "Unable to retrieve EXO Tenant ID with URI. This may be caused by proxy error see 'Running the Script Behind Some Proxies' in the README for a solution. $($_)"

        }

        $EXOTenantInfo = @{

            "DisplayName"= $OrgConfig.DisplayName;

            "DomainName" = $DomainName;

            "TenantId" = $TenantId;

            "EXOAdditionalData" = "Unable to safely retrieve due to EXO API changes";

        }

        $EXOTenantInfo = ConvertTo-Json @($EXOTenantInfo) -Depth 4

        $EXOTenantInfo

    }

    catch {

        Write-Warning "Error retrieving Tenant details using Get-EXOTenantDetail $($_)"

        $EXOTenantInfo = @{

            "DisplayName" = "Error retrieving Display name";

            "DomainName" = "Error retrieving Domain name";

            "TenantId" = "Error retrieving Tenant ID";

            "EXOAdditionalData" = "Error retrieving additional data";

        }

        $EXOTenantInfo = ConvertTo-Json @($EXOTenantInfo) -Depth 4

        $EXOTenantInfo

    }

}

# A $script:scoped variable used to indicate the preferred DoH server.

# Initialize to empty string to indicate that we don't yet know the

# preferred server. Will be set when the Select-DohServer function is

# called.

$DohServer = ""

function Select-DohServer {

    <#

    .Description

    Iterates through several DoH servers. Returns the first successful server. If none are successful, returns $null.

    .Functionality

    Internal

    #>

    $DoHServers = @("cloudflare-dns.com", "[2606:4700:4700::1111]", "1.1.1.1")

    $PreferredServer = $null

    foreach ($Server in $DoHServers) {

        try {

            # Attempt to resolve a.root-servers.net over DoH. The domain chosen is somewhat

            # arbitrary, as we don't care what the answer is, only if the query succeeds/fails.

            # a.root-servers.net, the address of one of the DNS root servers, was chosen as a

            # benign, highly-available domain.

            $Uri = "https://$($Server)/dns-query?name=a.root-servers.net"

            Invoke-WebRequest -Headers @{"accept"="application/dns-json"} -Uri $Uri `

                -TimeoutSec 2 -UseBasicParsing -ErrorAction "Stop" | Out-Null

            # No error was thrown, return this server

            $PreferredServer = $Server

            break

        }

        catch {

            # This server didn't work, try the next one

            continue

        }

    }

    $PreferredServer

}

function Invoke-RobustDnsTxt {

    <#

    .Description

    Requests the TXT record for the given qname. First tries to make the query over traditional DNS

    but retries over DoH in the event of failure.

    .Parameter Qname

    The fully-qualified domain name to request.

    .Parameter MaxTries

    The number of times to retry each kind of query. If all queries are unsuccessful, the traditional

    queries and the DoH queries will each be made $MaxTries times. Default is 2.

    .Functionality

    Internal

    #>

    [CmdletBinding()]

    [OutputType([System.Collections.Hashtable])]

    param (

        [Parameter(Mandatory=$true)]

        [ValidateNotNullOrEmpty()]

        [string]

        $Qname,

        [Parameter(Mandatory=$false)]

        [ValidateRange(1, [int]::MaxValue)]

        [int]

        $MaxTries = 2

    )

    $Answers = @()

    $LogEntries = @()

    $TryNumber = 0

    $Success = $false

    $TradEmpty = $false

    while ($TryNumber -lt $MaxTries) {

        $TryNumber += 1

        try {

            $Response = Resolve-DnsName $Qname txt -ErrorAction Stop | Where-Object {$_.Section -eq "Answer"}

            if ($Response.Strings.Length -gt 0) {

                # We got our answer, so break out of the retry loop and set $Success to $true, no

                # need to retry the traditional query or retry with DoH.

                $LogEntries += @{

                    "query_name"=$Qname;

                    "query_method"="traditional";

                    "query_result"="Query returned $($Response.Strings.Length) txt records"

                }

                $Answers += $Response.Strings

                $Success = $true

                break

            }

            else {

                # The answer section was empty. This usually means that while the domain exists, but

                # there are no records of the requested type. No need to retry the traditional query,

                # this was not a transient failure. Don't set $Success to $true though, as we want to

                # retry this query from a public resolver, in case the internal DNS server returns a

                # different answer than what is served to the public (i.e., split horizon DNS).

                $LogEntries += @{

                    "query_name"=$Qname;

                    "query_method"="traditional";

                    "query_result"="Query returned 0 txt records"

                }

                $TradEmpty = $true

                break

            }

        }

        catch {

            if ($_.FullyQualifiedErrorId -eq "DNS_ERROR_RCODE_NAME_ERROR,Microsoft.DnsClient.Commands.ResolveDnsName") {

                # The server returned NXDomain, no need to retry the traditional query or retry with

                # DoH, this was not a transient failure. Break out of loop and set $Success to $true

                $LogEntries += @{

                    "query_name"=$Qname;

                    "query_method"="traditional";

                    "query_result"="Query returned NXDomain"

                }

                $Success = $True

                break

            }

            else {

                # The query failed, possibly a transient failure. Retry if we haven't reached $MaxsTries.

                $LogEntries += @{

                    "query_name"=$Qname;

                    "query_method"="traditional";

                    "query_result"="Query resulted in exception, $($_.FullyQualifiedErrorId)"

                }

            }

        }

    }

    if (-not $Success) {

        # The traditional DNS query(ies) failed. Retry with DoH

        if ($script:DohServer -eq "") {

            # We haven't determined if DoH is available yet, select the first server that works

            $script:DohServer = Select-DohServer

        }

        if ($null -eq $script:DohServer) {

            # None of the DoH servers are accessible

            $LogEntries += @{"query_name"=$Qname; "query_method"="DoH"; "query_result"="NA, DoH servers unreachable"}

        }

        else {

            # DoH is available, query for the domain

            $TryNumber = 0

            while ($TryNumber -lt $MaxTries) {

                $TryNumber += 1

                try {

                    $Uri = "https://$($script:DohServer)/dns-query?name=$($Qname)&type=txt"

                    $Headers = @{"accept"="application/dns-json"}

                    $RawResponse = $(Invoke-WebRequest -Headers $Headers -Uri $Uri -UseBasicParsing -ErrorAction "Stop").RawContent

                    $ResponseLines = $RawResponse -Split "`n"

                    $LastLine = $ResponseLines[$ResponseLines.Length - 1]

                    $ResponseBody = ConvertFrom-Json $LastLine

                    if ($ResponseBody.Status -eq 0) {

                        # 0 indicates there was no error

                        $LogEntries += @{

                            "query_name"=$Qname;

                            "query_method"="DoH";

                            "query_result"="Query returned $($ResponseBody.Answer.data.Length) txt records"

                        }

                        $Answers += ($ResponseBody.Answer.data | ForEach-Object {$_.Replace('"', '')})

                        $Success = $true

                        break

                    }

                    elseif ($ResponseBody.Status -eq 3) {

                        # 3 indicates NXDomain. The DNS query succeeded, but the domain did not exist.

                        # Set $Success to $true, because event though the domain does not exist, the

                        # query succeeded, and this came from an external resolver so split horizon is

                        # not an issue here.

                        $LogEntries += @{

                            "query_name"=$Qname;

                            "query_method"="DoH";

                            "query_result"="Query returned NXDomain"

                        }

                        $Success = $true

                        break

                    }

                    else {

                        # The remainder of the response codes indicate that the query did not succeed.

                        # Retry if we haven't reached $MaxTries.

                        $LogEntries += @{

                            "query_name"=$Qname;

                            "query_method"="DoH";

                            "query_result"="Query returned response code $($ResponseBody.Status)"

                        }

                    }

                }

                catch {

                    # The DoH query failed, likely due to a network issue. Retry if we haven't reached

                    # $MaxTries.

                    $LogEntries += @{

                        "query_name"=$Qname;

                        "query_method"="DoH";

                        "query_result"="Query resulted in exception, $($_.FullyQualifiedErrorId)"

                    }

                }

            }

        }

    }

    # There are three possible outcomes of this function:

    # - Full confidence: we know conclusively that the domain exists or not, either via a non-empty

    # answer from traditional DNS or an answer from DoH.

    # - Medium confidence: domain likely doesn't exist, but there is some doubt (empty answer from

    # traditonal DNS and DoH failed).

    # No confidence: all queries failed. Throw an exception in this case.

    if ($Success) {

        @{"Answers" = $Answers; "HighConfidence" = $true; "LogEntries" = $LogEntries}

    }

    elseif ($TradEmpty) {

        @{"Answers" = $Answers; "HighConfidence" = $false; "LogEntries" = $LogEntries}

    }

    else {

        $Log = ($LogEntries | ForEach-Object {ConvertTo-Json $_ -Compress}) -Join "`n"

        throw "Failed to resolve $($Qname). `n$($Log)"

    }

}

function Get-ScubaSpfRecord {

    <#

    .Description

    Gets the SPF records for each domain in $Domains

    .Functionality

    Internal

    #>

    [CmdletBinding()]

    param (

        [Parameter(Mandatory=$true)]

        [ValidateNotNullOrEmpty()]

        [System.Object[]]

        $Domains

    )

    $SPFRecords = @()

    $NLowConf = 0

    foreach ($d in $Domains) {

        $Response = Invoke-RobustDnsTxt $d.DomainName

        if (-not $Response.HighConfidence) {

            $NLowConf += 1

        }

        $DomainName = $d.DomainName

        $SPFRecords += [PSCustomObject]@{

            "domain" = $DomainName;

            "rdata" = $Response.Answers;

            "log" = $Response.LogEntries;

        }

    }

    if ($NLowConf -gt 0) {

        Write-Warning "Get-ScubaSpfRecord: for $($NLowConf) domain(s), the tradtional DNS queries returned an empty answer section and the DoH queries failed. Will assume SPF not configured, but can't guarantee that failure isn't due to something like split horizon DNS. See ProviderSettingsExport.json under 'spf_records' for more details."

    }

    $DnsLog += $Response.LogEntries

    $SPFRecords

}

function Get-ScubaDkimRecord {

    <#

    .Description

    Gets the DKIM records for each domain in $Domains

    .Functionality

    Internal

    #>

    [CmdletBinding()]

    param (

        [Parameter(Mandatory=$true)]

        [ValidateNotNullOrEmpty()]

        [System.Object[]]

        $Domains

    )

    $DKIMRecords = @()

    $NLowConf = 0

    foreach ($d in $domains) {

        $DomainName = $d.DomainName

        $selectors = "selector1", "selector2"

        $selectors += "selector1.$DomainName" -replace "\.", "-"

        $selectors += "selector2.$DomainName" -replace "\.", "-"

        $LogEntries = @()

        foreach ($s in $selectors) {

            $Response = Invoke-RobustDnsTxt "$s._domainkey.$DomainName"

            $LogEntries += $Response.LogEntries

            if ($Response.Answers.Length -eq 0) {

                # The DKIM record does not exist with this selector, we need to try again with

                # a different one

                continue

            }

            else {

                # The DKIM record exists with this selector, no need to try the rest

                break

            }

        }

        if (-not $Response.HighConfidence) {

            $NLowConf += 1

        }

        $DKIMRecords += [PSCustomObject]@{

            "domain" = $DomainName;

            "rdata" = $Response.Answers;

            "log" = $LogEntries;

        }

    }

    if ($NLowConf -gt 0) {

        Write-Warning "Get-ScubaDkimRecord: for $($NLowConf) domain(s), the tradtional DNS queries returned an empty answer section and the DoH queries failed. Will assume DKIM not configured, but can't guarantee that failure isn't due to something like split horizon DNS. See ProviderSettingsExport.json under 'dkim_records' for more details."

    }

    $DKIMRecords

}

function Get-ScubaDmarcRecord {

    <#

    .Description

    Gets the DMARC records for each domain in $Domains

    .Functionality

    Internal

    #>

    [CmdletBinding()]

    param (

        [Parameter(Mandatory=$true)]

        [ValidateNotNullOrEmpty()]

        [System.Object[]]

        $Domains

    )

    $DMARCRecords = @()

    $NLowConf = 0

    foreach ($d in $Domains) {

    $LogEntries = @()

        # First check to see if the record is available at the full domain level

        $DomainName = $d.DomainName

        $Response = Invoke-RobustDnsTxt "_dmarc.$DomainName"

        $LogEntries += $Response.LogEntries

        if ($Response.Answers.Length -eq 0) {

            # The domain does not exist. If the record is not available at the full domain

            # level, we need to check at the organizational domain level.

            $Labels = $d.DomainName.Split(".")

            $Labels = $d.DomainName.Split(".")

            $OrgDomain = $Labels[-2] + "." + $Labels[-1]

            $Response = Invoke-RobustDnsTxt "_dmarc.$OrgDomain"

            $LogEntries += $Response.LogEntries

        }

        $DomainName = $d.DomainName

        if (-not $Response.HighConfidence) {

            $NLowConf += 1

        }

        $DMARCRecords += [PSCustomObject]@{

            "domain" = $DomainName;

            "rdata" = @($Response.Answers);

            "log" = $LogEntries;

        }

    }

    if ($NLowConf -gt 0) {

        Write-Warning "Get-ScubaDmarcRecord: for $($NLowConf) domain(s), the tradtional DNS queries returned an empty answer section and the DoH queries failed. Will assume DMARC not configured, but can't guarantee that failure isn't due to something like split horizon DNS. See ProviderSettingsExport.json under 'dmarc_records' for more details."

    }

    $DMARCRecords

}

# SIG # Begin signature block

# MIIuwAYJKoZIhvcNAQcCoIIusTCCLq0CAQExDzANBglghkgBZQMEAgEFADB5Bgor

# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG

# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCDOVo/OdFmHEXhu

# ZeCH8hsCPpc9gyTDaoyNeA5Vl0djxqCCE6MwggWQMIIDeKADAgECAhAFmxtXno4h

# MuI5B72nd3VcMA0GCSqGSIb3DQEBDAUAMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQK

# EwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNV

# BAMTGERpZ2lDZXJ0IFRydXN0ZWQgUm9vdCBHNDAeFw0xMzA4MDExMjAwMDBaFw0z

# ODAxMTUxMjAwMDBaMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJ

# bmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0

# IFRydXN0ZWQgUm9vdCBHNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB

# AL/mkHNo3rvkXUo8MCIwaTPswqclLskhPfKK2FnC4SmnPVirdprNrnsbhA3EMB/z

# G6Q4FutWxpdtHauyefLKEdLkX9YFPFIPUh/GnhWlfr6fqVcWWVVyr2iTcMKyunWZ

# anMylNEQRBAu34LzB4TmdDttceItDBvuINXJIB1jKS3O7F5OyJP4IWGbNOsFxl7s

# Wxq868nPzaw0QF+xembud8hIqGZXV59UWI4MK7dPpzDZVu7Ke13jrclPXuU15zHL

# 2pNe3I6PgNq2kZhAkHnDeMe2scS1ahg4AxCN2NQ3pC4FfYj1gj4QkXCrVYJBMtfb

# BHMqbpEBfCFM1LyuGwN1XXhm2ToxRJozQL8I11pJpMLmqaBn3aQnvKFPObURWBf3

# JFxGj2T3wWmIdph2PVldQnaHiZdpekjw4KISG2aadMreSx7nDmOu5tTvkpI6nj3c

# AORFJYm2mkQZK37AlLTSYW3rM9nF30sEAMx9HJXDj/chsrIRt7t/8tWMcCxBYKqx

# YxhElRp2Yn72gLD76GSmM9GJB+G9t+ZDpBi4pncB4Q+UDCEdslQpJYls5Q5SUUd0

# viastkF13nqsX40/ybzTQRESW+UQUOsxxcpyFiIJ33xMdT9j7CFfxCBRa2+xq4aL

# T8LWRV+dIPyhHsXAj6KxfgommfXkaS+YHS312amyHeUbAgMBAAGjQjBAMA8GA1Ud

# EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMB0GA1UdDgQWBBTs1+OC0nFdZEzf

# Lmc/57qYrhwPTzANBgkqhkiG9w0BAQwFAAOCAgEAu2HZfalsvhfEkRvDoaIAjeNk

# aA9Wz3eucPn9mkqZucl4XAwMX+TmFClWCzZJXURj4K2clhhmGyMNPXnpbWvWVPjS

# PMFDQK4dUPVS/JA7u5iZaWvHwaeoaKQn3J35J64whbn2Z006Po9ZOSJTROvIXQPK

# 7VB6fWIhCoDIc2bRoAVgX+iltKevqPdtNZx8WorWojiZ83iL9E3SIAveBO6Mm0eB

# cg3AFDLvMFkuruBx8lbkapdvklBtlo1oepqyNhR6BvIkuQkRUNcIsbiJeoQjYUIp

# 5aPNoiBB19GcZNnqJqGLFNdMGbJQQXE9P01wI4YMStyB0swylIQNCAmXHE/A7msg

# dDDS4Dk0EIUhFQEI6FUy3nFJ2SgXUE3mvk3RdazQyvtBuEOlqtPDBURPLDab4vri

# RbgjU2wGb2dVf0a1TD9uKFp5JtKkqGKX0h7i7UqLvBv9R0oN32dmfrJbQdA75PQ7

# 9ARj6e/CVABRoIoqyc54zNXqhwQYs86vSYiv85KZtrPmYQ/ShQDnUBrkG5WdGaG5

# nLGbsQAe79APT0JsyQq87kP6OnGlyE0mpTX9iV28hWIdMtKgK1TtmlfB2/oQzxm3

# i0objwG2J5VT6LaJbVu8aNQj6ItRolb58KaAoNYes7wPD1N1KarqE3fk3oyBIa0H

# EEcRrYc9B9F1vM/zZn4wggawMIIEmKADAgECAhAIrUCyYNKcTJ9ezam9k67ZMA0G

# CSqGSIb3DQEBDAUAMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJ

# bmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0

# IFRydXN0ZWQgUm9vdCBHNDAeFw0yMTA0MjkwMDAwMDBaFw0zNjA0MjgyMzU5NTla

# MGkxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjFBMD8GA1UE

# AxM4RGlnaUNlcnQgVHJ1c3RlZCBHNCBDb2RlIFNpZ25pbmcgUlNBNDA5NiBTSEEz

# ODQgMjAyMSBDQTEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDVtC9C

# 0CiteLdd1TlZG7GIQvUzjOs9gZdwxbvEhSYwn6SOaNhc9es0JAfhS0/TeEP0F9ce

# 2vnS1WcaUk8OoVf8iJnBkcyBAz5NcCRks43iCH00fUyAVxJrQ5qZ8sU7H/Lvy0da

# E6ZMswEgJfMQ04uy+wjwiuCdCcBlp/qYgEk1hz1RGeiQIXhFLqGfLOEYwhrMxe6T

# SXBCMo/7xuoc82VokaJNTIIRSFJo3hC9FFdd6BgTZcV/sk+FLEikVoQ11vkunKoA

# FdE3/hoGlMJ8yOobMubKwvSnowMOdKWvObarYBLj6Na59zHh3K3kGKDYwSNHR7Oh

# D26jq22YBoMbt2pnLdK9RBqSEIGPsDsJ18ebMlrC/2pgVItJwZPt4bRc4G/rJvmM

# 1bL5OBDm6s6R9b7T+2+TYTRcvJNFKIM2KmYoX7BzzosmJQayg9Rc9hUZTO1i4F4z

# 8ujo7AqnsAMrkbI2eb73rQgedaZlzLvjSFDzd5Ea/ttQokbIYViY9XwCFjyDKK05

# huzUtw1T0PhH5nUwjewwk3YUpltLXXRhTT8SkXbev1jLchApQfDVxW0mdmgRQRNY

# mtwmKwH0iU1Z23jPgUo+QEdfyYFQc4UQIyFZYIpkVMHMIRroOBl8ZhzNeDhFMJlP

# /2NPTLuqDQhTQXxYPUez+rbsjDIJAsxsPAxWEQIDAQABo4IBWTCCAVUwEgYDVR0T

# AQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHwYD

# VR0jBBgwFoAU7NfjgtJxXWRM3y5nP+e6mK4cD08wDgYDVR0PAQH/BAQDAgGGMBMG

# A1UdJQQMMAoGCCsGAQUFBwMDMHcGCCsGAQUFBwEBBGswaTAkBggrBgEFBQcwAYYY

# aHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEEGCCsGAQUFBzAChjVodHRwOi8vY2Fj

# ZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNydDBDBgNV

# HR8EPDA6MDigNqA0hjJodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRU

# cnVzdGVkUm9vdEc0LmNybDAcBgNVHSAEFTATMAcGBWeBDAEDMAgGBmeBDAEEATAN

# BgkqhkiG9w0BAQwFAAOCAgEAOiNEPY0Idu6PvDqZ01bgAhql+Eg08yy25nRm95Ry

# sQDKr2wwJxMSnpBEn0v9nqN8JtU3vDpdSG2V1T9J9Ce7FoFFUP2cvbaF4HZ+N3HL

# IvdaqpDP9ZNq4+sg0dVQeYiaiorBtr2hSBh+3NiAGhEZGM1hmYFW9snjdufE5Btf

# Q/g+lP92OT2e1JnPSt0o618moZVYSNUa/tcnP/2Q0XaG3RywYFzzDaju4ImhvTnh

# OE7abrs2nfvlIVNaw8rpavGiPttDuDPITzgUkpn13c5UbdldAhQfQDN8A+KVssIh

# dXNSy0bYxDQcoqVLjc1vdjcshT8azibpGL6QB7BDf5WIIIJw8MzK7/0pNVwfiThV

# 9zeKiwmhywvpMRr/LhlcOXHhvpynCgbWJme3kuZOX956rEnPLqR0kq3bPKSchh/j

# wVYbKyP/j7XqiHtwa+aguv06P0WmxOgWkVKLQcBIhEuWTatEQOON8BUozu3xGFYH

# Ki8QxAwIZDwzj64ojDzLj4gLDb879M4ee47vtevLt/B3E+bnKD+sEq6lLyJsQfmC

# XBVmzGwOysWGw/YmMwwHS6DTBwJqakAwSEs0qFEgu60bhQjiWQ1tygVQK+pKHJ6l

# /aCnHwZ05/LWUpD9r4VIIflXO7ScA+2GRfS0YW6/aOImYIbqyK+p/pQd52MbOoZW

# eE4wggdXMIIFP6ADAgECAhANkQ8dPvvR0q3Ytt4H0T3aMA0GCSqGSIb3DQEBCwUA

# MGkxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjFBMD8GA1UE

# AxM4RGlnaUNlcnQgVHJ1c3RlZCBHNCBDb2RlIFNpZ25pbmcgUlNBNDA5NiBTSEEz

# ODQgMjAyMSBDQTEwHhcNMjQwMTMwMDAwMDAwWhcNMjUwMTI5MjM1OTU5WjBfMQsw

# CQYDVQQGEwJVUzEdMBsGA1UECBMURGlzdHJpY3Qgb2YgQ29sdW1iaWExEzARBgNV

# BAcTCldhc2hpbmd0b24xDTALBgNVBAoTBENJU0ExDTALBgNVBAMTBENJU0EwggIi

# MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCT1y7uJCQax8JfiDEYgpiU9URj

# EXCTRqtZbDALM9rPUudiuM3mj6A1SUSAAWYv6DTsvGPvxyMI2Idg0mQunl4Ms9DJ

# yVwe5k4+Anj/73Nx1AbOPYP8xRZcD10FkctKGhV0PzvrDcwU15hsQWtiepFgg+bX

# fHkGMeu426oc69f43vKE43DiqKTf0/UBX/qgpj3JZvJ3zc1kilBOv4sBCksfCjbW

# tLZD0tqAgBsNPo3Oy5mQG31E1eZdTNvrdTnEXacSwb3k615z7mHy7nqBUkOruZ9E

# tnvC2qla+uL3ks91O/e/LnKzH9Lj1JmEBf6jwPN/MYR9Dymni4Mi3AQ8mpQMyFmi

# XcSHymibSNbtTMavpdBWjFfrcvPETX7krROUOoLzMQmNgHArceSh55tgvDRdSU5c

# WK3BTvK3l3mgCdgjre7XGYxV3W8apyxk5+RKfHdbv9cpRwpSuDnI8sHeqmB3fnfo

# Cr1PPu4WhKegt20CobhDVybiBdhDVqUdR53ful4N/coQOEHDrIExB5nJf9Pvdrza

# DyIGKAMIXD79ba5/rQEo+2cA66oJkPlvB5hEGI/jtDcYwDBgalbwB7Kc8zAAhl6+

# JvHfYpXOkppSfEQbaRXZI+LGXWQAFa5pJDfDEAyZSXprStgw594sWUOysp+UOxFe

# kSA4mBr0o1jVpdaulwIDAQABo4ICAzCCAf8wHwYDVR0jBBgwFoAUaDfg67Y7+F8R

# hvv+YXsIiGX0TkIwHQYDVR0OBBYEFAmyTB5bcWyA+8+rq540jPRLJ1nYMD4GA1Ud

# IAQ3MDUwMwYGZ4EMAQQBMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNl

# cnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMw

# gbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0Rp

# Z2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5j

# cmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0

# ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMIGUBggrBgEF

# BQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29t

# MFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNl

# cnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNydDAJ

# BgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQAh2Jnt9IPoBvOQlYQUlCP9iJ5y

# XAvEWe1camOwedqMZsHEPpT2yd6+fMzPZmV3/bYJgaN2OrDS1snf62S7yc+AulVw

# PAXSp1lSAiFEbZ6PFEdEBIag9B65Mp/cvRtJsIWQIc//jWqFMHpkU6r3MW9YARRu

# vaIf5/0qlM4VEwn3lTf+jJdxhhyoOFTWWd3BrlMPcT06z6F6hFfyycQkZ3Y9wEJ3

# uOU9bCNLZL1HCjlKT+oI0WsgeRdbe2sYrnvv9NmDY9oEi8PEq+DGjiTgLbY5OcAX

# uUogPPw6gbcuNn8Hq6FFKPIQxaksB8dF8Gw4m2lQoUWESPRF8Zaq9lmZN3+QzA79

# yskfJtAFqz3gUP5wJBdNfi/u1sGbLI0QnJQkIKfFuz7DfDPldw0gIl05BIYwZBmj

# TpFRu1/+gIlP1Ul4L/wt9Lxk6pglObLsdxHP2UQrG30JaUN0gv3xZMBBByHGVVTe

# cyU4qwJ0ulMdv/kjHwh+m58uOF8gHXLfyBmOjYpohN3+l0rS0qdArZMNSmLTA7N8

# n3V3AZLKB//1yhPt++gR4pCFdXmgwYDDLRxjlV0cMsG1UeSQUdI0aieh/grg5TQO

# CergVXS5h3sz5U0ZQPWND41LJhA0gF2OGZNHdUc9+0dwTsfxAERrjaTdeZp0/rdZ

# 9iGBoiRsS4U86S8xkDGCGnMwghpvAgEBMH0waTELMAkGA1UEBhMCVVMxFzAVBgNV

# BAoTDkRpZ2lDZXJ0LCBJbmMuMUEwPwYDVQQDEzhEaWdpQ2VydCBUcnVzdGVkIEc0

# IENvZGUgU2lnbmluZyBSU0E0MDk2IFNIQTM4NCAyMDIxIENBMQIQDZEPHT770dKt

# 2LbeB9E92jANBglghkgBZQMEAgEFAKCBhDAYBgorBgEEAYI3AgEMMQowCKACgACh

# AoAAMBkGCSqGSIb3DQEJAzEMBgorBgEEAYI3AgEEMBwGCisGAQQBgjcCAQsxDjAM

# BgorBgEEAYI3AgEVMC8GCSqGSIb3DQEJBDEiBCDodz9WFSftL76K84sLZeea9H70

# v7VlsVH4vKkdQ2ohhzANBgkqhkiG9w0BAQEFAASCAgBSjz6ZCXlj+QNjzgvFM+DK

# 0AGFoR03IgLI1k5BC6OG8rfwzby7hgai+XHsAuGuCrcLdPsAHiJn1CuimWqvEpf8

# f/XgZYhEBcaGY6g3Amw5mmTsi4586wNrFCT5IZ5r9/jDoyrI/t1Xk3p4RfHCxW51

# romG40q7z+LJSRgJAUflLZBzoySzgg4ECqCHwlRjUGuo7F1v7EqURP6LuQt/n43n

# /GaqerILu1cpM8ybJE99cL9jLDGVg/R6XdIUbvEJDQ+XXABUgUGuxbPnj/pQD6lr

# ecXR0toG2Jutt0+TT4ppud6eMduaOYxaxjlLYF42NR4y5kkNE2d5WBAAJZc0kd7Z

# 5sUmUYAYRoAvJpOVdA8vA/pBMyUAn/IkEgXGEOZ7CWxhaWVqnl+FFGwlGad3vhjV

# IgbQzsI1+dgLAwYOlu62GHwT/zjCVxVfPYMOglcPxWWcQTAgAILWkQYIJtyPKE2C

# gmksGMoS5uf1vYgplhGTwj95BmbCDMKgAKiqjFii6VYxQQtPX+AzqZ3FPoS7PQfu

# FgvuJa9oiPVQXLO6MZ3dUYl6lsF1A6JKJTxidXOjz1rxIpjW0wTNWGW98DDSh2CE

# AFqa47J0oBbjh/fYT7r++GOt/9cURrjqf4bn3BLhtvmSEBZp70XHB3z8ME9jTL+2

# pOuCemGH9vMxdMBCSBfgCaGCF0Awghc8BgorBgEEAYI3AwMBMYIXLDCCFygGCSqG

# SIb3DQEHAqCCFxkwghcVAgEDMQ8wDQYJYIZIAWUDBAIBBQAweAYLKoZIhvcNAQkQ

# AQSgaQRnMGUCAQEGCWCGSAGG/WwHATAxMA0GCWCGSAFlAwQCAQUABCBWBfjEuW5o

# F7OfhKBeiAQDF/uR0W73FMu1dW5DQ6kWfAIRAOwHGlBlLOyputfZy9zLwtUYDzIw

# MjQwNjEyMTMxNDQyWqCCEwkwggbCMIIEqqADAgECAhAFRK/zlJ0IOaa/2z9f5WEW

# MA0GCSqGSIb3DQEBCwUAMGMxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2Vy

# dCwgSW5jLjE7MDkGA1UEAxMyRGlnaUNlcnQgVHJ1c3RlZCBHNCBSU0E0MDk2IFNI

# QTI1NiBUaW1lU3RhbXBpbmcgQ0EwHhcNMjMwNzE0MDAwMDAwWhcNMzQxMDEzMjM1

# OTU5WjBIMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xIDAe

# BgNVBAMTF0RpZ2lDZXJ0IFRpbWVzdGFtcCAyMDIzMIICIjANBgkqhkiG9w0BAQEF

# AAOCAg8AMIICCgKCAgEAo1NFhx2DjlusPlSzI+DPn9fl0uddoQ4J3C9Io5d6Oyqc

# Z9xiFVjBqZMRp82qsmrdECmKHmJjadNYnDVxvzqX65RQjxwg6seaOy+WZuNp52n+

# W8PWKyAcwZeUtKVQgfLPywemMGjKg0La/H8JJJSkghraarrYO8pd3hkYhftF6g1h

# bJ3+cV7EBpo88MUueQ8bZlLjyNY+X9pD04T10Mf2SC1eRXWWdf7dEKEbg8G45lKV

# tUfXeCk5a+B4WZfjRCtK1ZXO7wgX6oJkTf8j48qG7rSkIWRw69XloNpjsy7pBe6q

# 9iT1HbybHLK3X9/w7nZ9MZllR1WdSiQvrCuXvp/k/XtzPjLuUjT71Lvr1KAsNJvj

# 3m5kGQc3AZEPHLVRzapMZoOIaGK7vEEbeBlt5NkP4FhB+9ixLOFRr7StFQYU6mII

# E9NpHnxkTZ0P387RXoyqq1AVybPKvNfEO2hEo6U7Qv1zfe7dCv95NBB+plwKWEwA

# PoVpdceDZNZ1zY8SdlalJPrXxGshuugfNJgvOuprAbD3+yqG7HtSOKmYCaFxsmxx

# rz64b5bV4RAT/mFHCoz+8LbH1cfebCTwv0KCyqBxPZySkwS0aXAnDU+3tTbRyV8I

# pHCj7ArxES5k4MsiK8rxKBMhSVF+BmbTO77665E42FEHypS34lCh8zrTioPLQHsC

# AwEAAaOCAYswggGHMA4GA1UdDwEB/wQEAwIHgDAMBgNVHRMBAf8EAjAAMBYGA1Ud

# JQEB/wQMMAoGCCsGAQUFBwMIMCAGA1UdIAQZMBcwCAYGZ4EMAQQCMAsGCWCGSAGG

# /WwHATAfBgNVHSMEGDAWgBS6FtltTYUvcyl2mi91jGogj57IbzAdBgNVHQ4EFgQU

# pbbvE+fvzdBkodVWqWUxo97V40kwWgYDVR0fBFMwUTBPoE2gS4ZJaHR0cDovL2Ny

# bDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0UlNBNDA5NlNIQTI1NlRp

# bWVTdGFtcGluZ0NBLmNybDCBkAYIKwYBBQUHAQEEgYMwgYAwJAYIKwYBBQUHMAGG

# GGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBYBggrBgEFBQcwAoZMaHR0cDovL2Nh

# Y2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0UlNBNDA5NlNIQTI1

# NlRpbWVTdGFtcGluZ0NBLmNydDANBgkqhkiG9w0BAQsFAAOCAgEAgRrW3qCptZgX

# vHCNT4o8aJzYJf/LLOTN6l0ikuyMIgKpuM+AqNnn48XtJoKKcS8Y3U623mzX4WCc

# K+3tPUiOuGu6fF29wmE3aEl3o+uQqhLXJ4Xzjh6S2sJAOJ9dyKAuJXglnSoFeoQp

# mLZXeY/bJlYrsPOnvTcM2Jh2T1a5UsK2nTipgedtQVyMadG5K8TGe8+c+njikxp2

# oml101DkRBK+IA2eqUTQ+OVJdwhaIcW0z5iVGlS6ubzBaRm6zxbygzc0brBBJt3e

# WpdPM43UjXd9dUWhpVgmagNF3tlQtVCMr1a9TMXhRsUo063nQwBw3syYnhmJA+rU

# kTfvTVLzyWAhxFZH7doRS4wyw4jmWOK22z75X7BC1o/jF5HRqsBV44a/rCcsQdCa

# M0qoNtS5cpZ+l3k4SF/Kwtw9Mt911jZnWon49qfH5U81PAC9vpwqbHkB3NpE5jre

# ODsHXjlY9HxzMVWggBHLFAx+rrz+pOt5Zapo1iLKO+uagjVXKBbLafIymrLS2Dq4

# sUaGa7oX/cR3bBVsrquvczroSUa31X/MtjjA2Owc9bahuEMs305MfR5ocMB3CtQC

# 4Fxguyj/OOVSWtasFyIjTvTs0xf7UGv/B3cfcZdEQcm4RtNsMnxYL2dHZeUbc7aZ

# +WssBkbvQR7w8F/g29mtkIBEr4AQQYowggauMIIElqADAgECAhAHNje3JFR82Ees

# /ShmKl5bMA0GCSqGSIb3DQEBCwUAMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxE

# aWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMT

# GERpZ2lDZXJ0IFRydXN0ZWQgUm9vdCBHNDAeFw0yMjAzMjMwMDAwMDBaFw0zNzAz

# MjIyMzU5NTlaMGMxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5j

# LjE7MDkGA1UEAxMyRGlnaUNlcnQgVHJ1c3RlZCBHNCBSU0E0MDk2IFNIQTI1NiBU

# aW1lU3RhbXBpbmcgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDG

# hjUGSbPBPXJJUVXHJQPE8pE3qZdRodbSg9GeTKJtoLDMg/la9hGhRBVCX6SI82j6

# ffOciQt/nR+eDzMfUBMLJnOWbfhXqAJ9/UO0hNoR8XOxs+4rgISKIhjf69o9xBd/

# qxkrPkLcZ47qUT3w1lbU5ygt69OxtXXnHwZljZQp09nsad/ZkIdGAHvbREGJ3Hxq

# V3rwN3mfXazL6IRktFLydkf3YYMZ3V+0VAshaG43IbtArF+y3kp9zvU5EmfvDqVj

# bOSmxR3NNg1c1eYbqMFkdECnwHLFuk4fsbVYTXn+149zk6wsOeKlSNbwsDETqVcp

# licu9Yemj052FVUmcJgmf6AaRyBD40NjgHt1biclkJg6OBGz9vae5jtb7IHeIhTZ

# girHkr+g3uM+onP65x9abJTyUpURK1h0QCirc0PO30qhHGs4xSnzyqqWc0Jon7ZG

# s506o9UD4L/wojzKQtwYSH8UNM/STKvvmz3+DrhkKvp1KCRB7UK/BZxmSVJQ9FHz

# NklNiyDSLFc1eSuo80VgvCONWPfcYd6T/jnA+bIwpUzX6ZhKWD7TA4j+s4/TXkt2

# ElGTyYwMO1uKIqjBJgj5FBASA31fI7tk42PgpuE+9sJ0sj8eCXbsq11GdeJgo1gJ

# ASgADoRU7s7pXcheMBK9Rp6103a50g5rmQzSM7TNsQIDAQABo4IBXTCCAVkwEgYD

# VR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUuhbZbU2FL3MpdpovdYxqII+eyG8w

# HwYDVR0jBBgwFoAU7NfjgtJxXWRM3y5nP+e6mK4cD08wDgYDVR0PAQH/BAQDAgGG

# MBMGA1UdJQQMMAoGCCsGAQUFBwMIMHcGCCsGAQUFBwEBBGswaTAkBggrBgEFBQcw

# AYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEEGCCsGAQUFBzAChjVodHRwOi8v

# Y2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNydDBD

# BgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNl

# cnRUcnVzdGVkUm9vdEc0LmNybDAgBgNVHSAEGTAXMAgGBmeBDAEEAjALBglghkgB

# hv1sBwEwDQYJKoZIhvcNAQELBQADggIBAH1ZjsCTtm+YqUQiAX5m1tghQuGwGC4Q

# TRPPMFPOvxj7x1Bd4ksp+3CKDaopafxpwc8dB+k+YMjYC+VcW9dth/qEICU0MWfN

# thKWb8RQTGIdDAiCqBa9qVbPFXONASIlzpVpP0d3+3J0FNf/q0+KLHqrhc1DX+1g

# tqpPkWaeLJ7giqzl/Yy8ZCaHbJK9nXzQcAp876i8dU+6WvepELJd6f8oVInw1Ypx

# dmXazPByoyP6wCeCRK6ZJxurJB4mwbfeKuv2nrF5mYGjVoarCkXJ38SNoOeY+/um

# nXKvxMfBwWpx2cYTgAnEtp/Nh4cku0+jSbl3ZpHxcpzpSwJSpzd+k1OsOx0ISQ+U

# zTl63f8lY5knLD0/a6fxZsNBzU+2QJshIUDQtxMkzdwdeDrknq3lNHGS1yZr5Dhz

# q6YBT70/O3itTK37xJV77QpfMzmHQXh6OOmc4d0j/R0o08f56PGYX/sr2H7yRp11

# LB4nLCbbbxV7HhmLNriT1ObyF5lZynDwN7+YAN8gFk8n+2BnFqFmut1VwDophrCY

# oCvtlUG3OtUVmDG0YgkPCr2B2RP+v6TR81fZvAT6gt4y3wSJ8ADNXcL50CN/AAvk

# dgIm2fBldkKmKYcJRyvmfxqkhQ/8mJb2VVQrH4D6wPIOK+XW+6kvRBVK5xMOHds3

# OBqhK/bt1nz8MIIFjTCCBHWgAwIBAgIQDpsYjvnQLefv21DiCEAYWjANBgkqhkiG

# 9w0BAQwFADBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkw

# FwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1

# cmVkIElEIFJvb3QgQ0EwHhcNMjIwODAxMDAwMDAwWhcNMzExMTA5MjM1OTU5WjBi

# MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3

# d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3Qg

# RzQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC/5pBzaN675F1KPDAi

# MGkz7MKnJS7JIT3yithZwuEppz1Yq3aaza57G4QNxDAf8xukOBbrVsaXbR2rsnny

# yhHS5F/WBTxSD1Ifxp4VpX6+n6lXFllVcq9ok3DCsrp1mWpzMpTREEQQLt+C8weE

# 5nQ7bXHiLQwb7iDVySAdYyktzuxeTsiT+CFhmzTrBcZe7FsavOvJz82sNEBfsXpm

# 7nfISKhmV1efVFiODCu3T6cw2Vbuyntd463JT17lNecxy9qTXtyOj4DatpGYQJB5

# w3jHtrHEtWoYOAMQjdjUN6QuBX2I9YI+EJFwq1WCQTLX2wRzKm6RAXwhTNS8rhsD

# dV14Ztk6MUSaM0C/CNdaSaTC5qmgZ92kJ7yhTzm1EVgX9yRcRo9k98FpiHaYdj1Z

# XUJ2h4mXaXpI8OCiEhtmmnTK3kse5w5jrubU75KSOp493ADkRSWJtppEGSt+wJS0

# 0mFt6zPZxd9LBADMfRyVw4/3IbKyEbe7f/LVjHAsQWCqsWMYRJUadmJ+9oCw++hk

# pjPRiQfhvbfmQ6QYuKZ3AeEPlAwhHbJUKSWJbOUOUlFHdL4mrLZBdd56rF+NP8m8

# 00ERElvlEFDrMcXKchYiCd98THU/Y+whX8QgUWtvsauGi0/C1kVfnSD8oR7FwI+i

# sX4KJpn15GkvmB0t9dmpsh3lGwIDAQABo4IBOjCCATYwDwYDVR0TAQH/BAUwAwEB

# /zAdBgNVHQ4EFgQU7NfjgtJxXWRM3y5nP+e6mK4cD08wHwYDVR0jBBgwFoAUReui

# r/SSy4IxLVGLp6chnfNtyA8wDgYDVR0PAQH/BAQDAgGGMHkGCCsGAQUFBwEBBG0w

# azAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEMGCCsGAQUF

# BzAChjdodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVk

# SURSb290Q0EuY3J0MEUGA1UdHwQ+MDwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2lj

# ZXJ0LmNvbS9EaWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwEQYDVR0gBAowCDAG

# BgRVHSAAMA0GCSqGSIb3DQEBDAUAA4IBAQBwoL9DXFXnOF+go3QbPbYW1/e/Vwe9

# mqyhhyzshV6pGrsi+IcaaVQi7aSId229GhT0E0p6Ly23OO/0/4C5+KH38nLeJLxS

# A8hO0Cre+i1Wz/n096wwepqLsl7Uz9FDRJtDIeuWcqFItJnLnU+nBgMTdydE1Od/

# 6Fmo8L8vC6bp8jQ87PcDx4eo0kxAGTVGamlUsLihVo7spNU96LHc/RzY9HdaXFSM

# b++hUD38dglohJ9vytsgjTVgHAIDyyCwrFigDkBjxZgiwbJZ9VVrzyerbHbObyMt

# 9H5xaiNrIv8SuFQtJ37YOtnwtoeW/VvRXKwYw02fc7cBqZ9Xql4o4rmUMYIDdjCC

# A3ICAQEwdzBjMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4x

# OzA5BgNVBAMTMkRpZ2lDZXJ0IFRydXN0ZWQgRzQgUlNBNDA5NiBTSEEyNTYgVGlt

# ZVN0YW1waW5nIENBAhAFRK/zlJ0IOaa/2z9f5WEWMA0GCWCGSAFlAwQCAQUAoIHR

# MBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAcBgkqhkiG9w0BCQUxDxcNMjQw

# NjEyMTMxNDQyWjArBgsqhkiG9w0BCRACDDEcMBowGDAWBBRm8CsywsLJD4JdzqqK

# ycZPGZzPQDAvBgkqhkiG9w0BCQQxIgQgUXMIWQzXPSwtzdfmaC86sjGPuCwEFIrO

# 4SlHCIFlSUkwNwYLKoZIhvcNAQkQAi8xKDAmMCQwIgQg0vbkbe10IszR1EBXaEE2

# b4KK2lWarjMWr00amtQMeCgwDQYJKoZIhvcNAQEBBQAEggIAGuJjCLzb3HDoUpD9

# 1CXhYfH4ys9Apr3JQ4fe07nEOVGTQpL1NmrR8h+Es0zi8JeDYpm4+UPAcfg4DQTK

# d4y1vQfNJFfLe0ilMnN9G/pq3lau463DZIkUoVrjjtNP8nTng3YailbaM/W1+5ZZ

# L6ryLifJyYgs46oqdNAJuRbk9qAiRnnELbZ/hfCXuBSAVhG7L5AHHpnFRO6gR+62

# kW+mqYh8HwC2hSnvO2FnTVDGCc5B0nrv7RWErUbaw9PlHt2WRU5SJU1NCKXMSmWE

# oKsvAuYD7KSEBVVLMEriAADlGO0fqrVPXfLtNqx4XMsoOVvMscn8+0jLPmN+Rkkh

# tJCGb8byIS0w6rYWrMQ7Cb8ivwqHxfU4EqEeQuXHn2IWI88DJOGFl8Ze/q3qN+w5

# vBZDj0cMKxX+ZE4E4gY/xAqo+Y+zXn1LVWoTOjYjzh9QBHCUh75tNn4gFbpFiLrM

# Jfez0k8uIdrOyFDdfIQU4g4EreTUr1SuCbc0OEE5NuLzr83y2qOs7DhGOZfHFsiX

# gZsCFWQGQP68s2HzPbooshvZ/OHULw10e8qS2kcBIEjV8r/oIU5dPC7M+5NTHIsJ

# XUws6sT8LuxqgBWJKHwFBycdZZ9iD/TEalAVA2noXFbqlOwSSPaftsdRLi9ykc4B

# 3nckX6pzaiUXu1RsrT64nkHEMqE=

# SIG # End signature block