Modules/Providers/ProviderHelpers/AADConditionalAccessHelper.psm1
class CapHelper { <# .description Class for parsing conditional access policies (Caps) to generate a pre-processed version that can be used to generate the HTML table of the condiational access policies in the report. #> <# The following hashtables are used to map the codes used in the API output to human-friendly strings #> [System.Collections.Hashtable] $ExternalUserStrings = @{"b2bCollaborationGuest" = "B2B collaboration guest users"; "b2bCollaborationMember" = "B2B collaboration member users"; "b2bDirectConnectUser" = "B2B direct connect users"; "internalGuest" = "Local guest users"; "serviceProvider" = "Service provider users"; "otherExternalUser" = "Other external users"} [System.Collections.Hashtable] $StateStrings = @{"enabled" = "On"; "enabledForReportingButNotEnforced" = "Report-only"; "disabled" = "Off"} [System.Collections.Hashtable] $ActionStrings = @{"urn:user:registersecurityinfo" = "Register security info"; "urn:user:registerdevice" = "Register or join devices"} [System.Collections.Hashtable] $ClientAppStrings = @{"exchangeActiveSync" = "Exchange ActiveSync Clients"; "browser" = "Browser"; "mobileAppsAndDesktopClients" = "Mobile apps and desktop clients"; "other" = "Other clients"; "all" = "all"} [System.Collections.Hashtable] $GrantControlStrings = @{"mfa" = "multifactor authentication"; "compliantDevice" = "device to be marked compliant"; "domainJoinedDevice" = "Hybrid Azure AD joined device"; "approvedApplication" = "approved client app"; "compliantApplication" = "app protection policy"; "passwordChange" = "password change"} [System.Collections.Hashtable] $CondAccessAppControlStrings = @{"monitorOnly" = "Monitor only"; "blockDownloads" = "Block downloads"; "mcasConfigured" = "Use custom policy"} [string[]] GetMissingKeys([System.Object]$Obj, [string[]] $Keys) { <# .Description Returns a list of the keys in $Keys are not members of $Obj. Used to validate the structure of the conditonal access policies. .Functionality Internal #> $Missing = @() if ($null -eq $Obj) { # Note that $null needs to come first in the above check to keep the # linter happy. "$null should be on the left side of equality comparisons" return $Missing } foreach ($Key in $Keys) { $HasKey = [bool]($Obj.PSobject.Properties.name -match $Key) if (-not $HasKey) { $Missing += $Key } } return $Missing } [string[]] GetIncludedUsers([System.Object]$Cap) { <# .Description Parses a given conditional access policy (Cap) to generate the list of included users/roles used in the policy. .Functionality Internal #> # Perform some basic validation of the CAP. If some of these values # are missing it could indicate that the API has been restructured. $Missing = @() $Missing += $this.GetMissingKeys($Cap, @("Conditions")) $Missing += $this.GetMissingKeys($Cap.Conditions, @("Users")) $Missing += $this.GetMissingKeys($Cap.Conditions.Users, @("IncludeGroups", "IncludeGuestsOrExternalUsers", "IncludeRoles", "IncludeUsers")) if ($Missing.Length -gt 0) { Write-Warning "Conditional access policy structure not as expected. The following keys are missing: $($Missing -Join ', ')" return @() } # Begin processing the CAP $Output = @() $CapIncludedUsers = $Cap.Conditions.Users.IncludeUsers if ($CapIncludedUsers -Contains "All") { $Output += "All" } elseif ($CapIncludedUsers -Contains "None") { $Output += "None" } else { # Users if ($CapIncludedUsers.Length -eq 1) { $Output += "1 specific user" } elseif ($CapIncludedUsers.Length -gt 1) { $Output += "$($CapIncludedUsers.Length) specific users" } # Roles $CapIncludedRoles = $Cap.Conditions.Users.IncludeRoles if ($Cap.Conditions.Users.IncludeRoles.Length -eq 1) { $Output += "1 specific role" } elseif ($CapIncludedRoles.Length -gt 1) { $Output += "$($CapIncludedRoles.Length) specific roles" } # Groups $CapIncludedGroups = $Cap.Conditions.Users.IncludeGroups if ($CapIncludedGroups.Length -eq 1) { $Output += "1 specific group" } elseif ($CapIncludedGroups.Length -gt 1) { $Output += "$($CapIncludedGroups.Length) specific groups" } # External/guests if ($null -ne $Cap.Conditions.Users.IncludeGuestsOrExternalUsers.ExternalTenants.MembershipKind) { $GuestOrExternalUserTypes = $Cap.Conditions.Users.IncludeGuestsOrExternalUsers.GuestOrExternalUserTypes -Split "," $Output += @($GuestOrExternalUserTypes | ForEach-Object {$this.ExternalUserStrings[$_]}) } } return $Output } [string[]] GetExcludedUsers([System.Object]$Cap) { <# .Description Parses a given conditional access policy (Cap) to generate the list of excluded users/roles used in the policy. .Functionality Internal #> # Perform some basic validation of the CAP. If some of these values # are missing it could indicate that the API has been restructured. $Missing = @() $Missing += $this.GetMissingKeys($Cap, @("Conditions")) $Missing += $this.GetMissingKeys($Cap.Conditions, @("Users")) $Missing += $this.GetMissingKeys($Cap.Conditions.Users, @("ExcludeGroups", "ExcludeGuestsOrExternalUsers", "ExcludeRoles", "ExcludeUsers")) if ($Missing.Length -gt 0) { Write-Warning "Conditional access policy structure not as expected. The following keys are missing: $($Missing -Join ', ')" return @() } # Begin processing the CAP $Output = @() # Users $CapExcludedUsers = $Cap.Conditions.Users.ExcludeUsers if ($CapExcludedUsers.Length -eq 1) { $Output += "1 specific user" } elseif ($CapExcludedUsers.Length -gt 1) { $Output += "$($CapExcludedUsers.Length) specific users" } # Roles $CapExcludedRoles = $Cap.Conditions.Users.ExcludeRoles if ($CapExcludedRoles.Length -eq 1) { $Output += "1 specific role" } elseif ($CapExcludedRoles.Length -gt 1) { $Output += "$($CapExcludedRoles.Length) specific roles" } # Groups $CapExcludedGroups = $Cap.Conditions.Users.ExcludeGroups if ($CapExcludedGroups.Length -eq 1) { $Output += "1 specific group" } elseif ($CapExcludedGroups.Length -gt 1) { $Output += "$($CapExcludedGroups.Length) specific groups" } # External/guests if ($null -ne $Cap.Conditions.Users.ExcludeGuestsOrExternalUsers.ExternalTenants.MembershipKind) { $GuestOrExternalUserTypes = $Cap.Conditions.Users.ExcludeGuestsOrExternalUsers.GuestOrExternalUserTypes -Split "," $Output += @($GuestOrExternalUserTypes | ForEach-Object {$this.ExternalUserStrings[$_]}) } # If no users are excluded, rather than display an empty cell, display "None" if ($Output.Length -eq 0) { $Output += "None" } return $Output } [string[]] GetApplications([System.Object]$Cap) { <# .Description Parses a given conditional access policy (Cap) to generate the list of included/excluded applications/actions used in the policy. .Functionality Internal #> # Perform some basic validation of the CAP. If some of these values # are missing it could indicate that the API has been restructured. $Missing = @() $Missing += $this.GetMissingKeys($Cap, @("Conditions")) $Missing += $this.GetMissingKeys($Cap.Conditions, @("Applications")) $Missing += $this.GetMissingKeys($Cap.Conditions.Applications, @("ApplicationFilter", "ExcludeApplications", "IncludeApplications", "IncludeAuthenticationContextClassReferences", "IncludeUserActions")) if ($Missing.Length -gt 0) { Write-Warning "Conditional access policy structure not as expected. The following keys are missing: $($Missing -Join ', ')" return @() } # Begin processing the CAP $Output = @() $CapIncludedActions = $Cap.Conditions.Applications.IncludeUserActions $CapAppFilterMode = $Cap.Conditions.Applications.ApplicationFilter.Mode $CapIncludedApps = $Cap.Conditions.Applications.IncludeApplications if ($CapIncludedApps.Length -gt 0 -or $null -ne $CapAppFilterMode) { # For "Select what this policy applies to", "Cloud Apps" was selected $Output += "Policy applies to: apps" # Included apps: if ($CapIncludedApps -Contains "All") { $Output += "Apps included: All" } elseif ($CapIncludedApps -Contains "None") { $Output += "Apps included: None" } elseif ($CapIncludedApps.Length -eq 1) { $Output += "Apps included: 1 specific app" } elseif ($CapIncludedApps.Length -gt 1) { $Output += "Apps included: $($CapIncludedApps.Length) specific apps" } if ($CapAppFilterMode -eq "include") { $Output += "Apps included: custom application filter" } $CapExcludedApps = $Cap.Conditions.Applications.ExcludeApplications if ($CapExcludedApps.Length -eq 1) { $Output += "Apps excluded: 1 specific app" } elseif ($CapExcludedApps.Length -gt 1) { $Output += "Apps excluded: $($CapExcludedApps.Length) specific apps" } if ($CapAppFilterMode -eq "exclude") { $Output += "Apps excluded: custom application filter" } if ($CapAppFilterMode -ne "exclude" -and $CapExcludedApps.Length -eq 0) { $Output += "Apps excluded: None" } } elseif ($CapIncludedActions.Length -gt 0) { # For "Select what this policy applies to", "User actions" was selected $Output += "Policy applies to: actions" $Output += "User action: $($this.ActionStrings[$CapIncludedActions[0]])" # While "IncludeUserActions" is a list, the GUI doesn't actually let you select more than one # item at a time, hence "IncludeUserActions[0]" above } else { # For "Select what this policy applies to", "Authentication context" was selected $AuthContexts = $Cap.Conditions.Applications.IncludeAuthenticationContextClassReferences if ($AuthContexts.Length -eq 1) { $Output += "Policy applies to: 1 authentication context" } else { $Output += "Policy applies to: $($AuthContexts.Length) authentication contexts" } } return $Output } [string[]] GetConditions([System.Object]$Cap) { <# .Description Parses a given conditional access policy (Cap) to generate the list of conditions used in the policy. .Functionality Internal #> # Perform some basic validation of the CAP. If some of these values # are missing it could indicate that the API has been restructured. $Missing = @() $Missing += $this.GetMissingKeys($Cap, @("Conditions")) $Missing += $this.GetMissingKeys($Cap.Conditions, @("UserRiskLevels", "SignInRiskLevels", "Platforms", "Locations", "ClientAppTypes", "Devices")) $Missing += $this.GetMissingKeys($Cap.Conditions.Platforms, @("ExcludePlatforms", "IncludePlatforms")) $Missing += $this.GetMissingKeys($Cap.Conditions.Locations, @("ExcludeLocations", "IncludeLocations")) $Missing += $this.GetMissingKeys($Cap.Conditions.Devices, @("DeviceFilter")) if ($Missing.Length -gt 0) { Write-Warning "Conditional access policy structure not as expected. The following keys are missing: $($Missing -Join ', ')" return @() } # Begin processing the CAP $Output = @() # User risk $CapUserRiskLevels = $Cap.Conditions.UserRiskLevels if ($CapUserRiskLevels.Length -gt 0) { $Output += "User risk levels: $($CapUserRiskLevels -Join ', ')" } # Sign-in risk $CapSignInRiskLevels = $Cap.Conditions.SignInRiskLevels if ($CapSignInRiskLevels.Length -gt 0) { $Output += "Sign-in risk levels: $($CapSignInRiskLevels -Join ', ')" } # Device platforms $CapIncludedPlatforms = $Cap.Conditions.Platforms.IncludePlatforms if ($null -ne $CapIncludedPlatforms) { $Output += "Device platforms included: $($CapIncludedPlatforms -Join ', ')" $CapExcludedPlatforms = $Cap.Conditions.Platforms.ExcludePlatforms if ($CapExcludedPlatforms.Length -eq 0) { $Output += "Device platforms excluded: none" } else { $Output += "Device platforms excluded: $($CapExcludedPlatforms -Join ', ')" } } # Locations $CapIncludedLocations = $Cap.Conditions.Locations.IncludeLocations if ($null -ne $CapIncludedLocations) { if ($CapIncludedLocations -Contains "All") { $Output += "Locations included: all locations" } elseif ($CapIncludedLocations -Contains "AllTrusted") { $Output += "Locations included: all trusted locations" } elseif ($CapIncludedLocations.Length -eq 1) { $Output += "Locations included: 1 specific location" } else { $Output += "Locations included: $($CapIncludedLocations.Length) specific locations" } $CapExcludedLocations = $Cap.Conditions.Locations.ExcludeLocations if ($CapExcludedLocations -Contains "AllTrusted") { $Output += "Locations excluded: all trusted locations" } elseif ($CapExcludedLocations.Length -eq 0) { $Output += "Locations excluded: none" } elseif ($CapExcludedLocations.Length -eq 1) { $Output += "Locations excluded: 1 specific location" } else { $Output += "Locations excluded: $($CapExcludedLocations.Length) specific locations" } } # Client Apps $ClientApps += @($Cap.Conditions.ClientAppTypes | ForEach-Object {$this.ClientAppStrings[$_]}) $Output += "Client apps included: $($ClientApps -Join ', ')" # Filter for devices if ($null -ne $Cap.Conditions.Devices.DeviceFilter.Mode) { if ($Cap.Conditions.Devices.DeviceFilter.Mode -eq "include") { $Output += "Custom device filter in include mode active" } else { $Output += "Custom device filter in exclude mode active" } } return $Output } [string] GetAccessControls([System.Object]$Cap) { <# .Description Parses a given conditional access policy (Cap) to generate the list of access controls used in the policy. .Functionality Internal #> # Perform some basic validation of the CAP. If some of these values # are missing it could indicate that the API has been restructured. $Missing = @() $Missing += $this.GetMissingKeys($Cap, @("GrantControls")) $Missing += $this.GetMissingKeys($Cap.GrantControls, @("AuthenticationStrength", "BuiltInControls", "CustomAuthenticationFactors", "Operator", "TermsOfUse")) $Missing += $this.GetMissingKeys($Cap.GrantControls.AuthenticationStrength, @("DisplayName")) if ($Missing.Length -gt 0) { Write-Warning "Conditional access policy structure not as expected. The following keys are missing: $($Missing -Join ', ')" return @() } # Begin processing the CAP $Output = "" if ($null -ne $Cap.GrantControls.BuiltInControls) { if ($Cap.GrantControls.BuiltInControls -Contains "block") { $Output = "Block access" } else { $GrantControls = @($Cap.GrantControls.BuiltInControls | ForEach-Object {$this.GrantControlStrings[$_]}) if ($null -ne $Cap.GrantControls.AuthenticationStrength.DisplayName) { $GrantControls += "authentication strength ($($Cap.GrantControls.AuthenticationStrength.DisplayName))" } if ($Cap.GrantControls.TermsOfUse.Length -gt 0) { $GrantControls += "terms of use" } $Output = "Allow access but require $($GrantControls -Join ', ')" if ($GrantControls.Length -gt 1) { # If multiple access controls are in place, insert the AND or the OR # before the final access control $Output = $Output.Insert($Output.LastIndexOf(',')+1, " $($Cap.GrantControls.Operator)") } } } if ($Output -eq "") { $Output = "None" } return $Output } [string[]] GetSessionControls([System.Object]$Cap) { <# .Description Parses a given conditional access policy (Cap) to generate the list of session controls used in the policy. .Functionality Internal #> # Perform some basic validation of the CAP. If some of these values # are missing it could indicate that the API has been restructured. $Missing = @() $Missing += $this.GetMissingKeys($Cap, @("SessionControls")) $Missing += $this.GetMissingKeys($Cap.SessionControls, @("ApplicationEnforcedRestrictions", "CloudAppSecurity", "ContinuousAccessEvaluation", "DisableResilienceDefaults", "PersistentBrowser", "SignInFrequency")) $Missing += $this.GetMissingKeys($Cap.SessionControls.ApplicationEnforcedRestrictions, @("IsEnabled")) $Missing += $this.GetMissingKeys($Cap.SessionControls.CloudAppSecurity, @("CloudAppSecurityType", "IsEnabled")) $Missing += $this.GetMissingKeys($Cap.SessionControls.ContinuousAccessEvaluation, @("Mode")) $Missing += $this.GetMissingKeys($Cap.SessionControls.PersistentBrowser, @("IsEnabled", "Mode")) $Missing += $this.GetMissingKeys($Cap.SessionControls.SignInFrequency, @("IsEnabled", "FrequencyInterval", "Type", "Value")) if ($Missing.Length -gt 0) { Write-Warning "Conditional access policy structure not as expected. The following keys are missing: $($Missing -Join ', ')" return @() } # Begin processing the CAP $Output = @() if ($Cap.SessionControls.ApplicationEnforcedRestrictions.IsEnabled) { $Output += "Use app enforced restrictions" } if ($Cap.SessionControls.CloudAppSecurity.IsEnabled) { $Mode = $this.CondAccessAppControlStrings[$Cap.SessionControls.CloudAppSecurity.CloudAppSecurityType] $Output += "Use Conditional Access App Control ($($Mode))" } if ($Cap.SessionControls.SignInFrequency.IsEnabled) { if ($Cap.SessionControls.SignInFrequency.FrequencyInterval -eq "everyTime") { $Output += "Sign-in frequency (every time)" } else { $Value = $Cap.SessionControls.SignInFrequency.Value $Unit = $Cap.SessionControls.SignInFrequency.Type $Output += "Sign-in frequency (every $($Value) $($Unit))" } } if ($Cap.SessionControls.PersistentBrowser.IsEnabled) { $Mode = $Cap.SessionControls.PersistentBrowser.Mode $Output += "Persistent browser session ($($Mode) persistent)" } if ($Cap.SessionControls.ContinuousAccessEvaluation.Mode -eq "disabled") { $Output += "Customize continuous access evaluation" } if ($Cap.SessionControls.DisableResilienceDefaults) { $Output += "Disable resilience defaults" } if ($Output.Length -eq 0) { $Output += "None" } return $Output } [string] ExportCapPolicies([System.Object]$Caps) { <# .Description Parses the conditional access policies (Caps) to generate a pre-processed version that can be used to generate the HTML of the condiational access policies in the report. .Functionality Internal #> $Table = @() foreach ($Cap in $Caps) { $State = $this.StateStrings[$Cap.State] $UsersIncluded = $($this.GetIncludedUsers($Cap)) -Join ", " $UsersExcluded = $($this.GetExcludedUsers($Cap)) -Join ", " $Users = @("Users included: $($UsersIncluded)", "Users excluded: $($UsersExcluded)") $Apps = $this.GetApplications($Cap) $Conditions = $this.GetConditions($Cap) $AccessControls = $this.GetAccessControls($Cap) $SessionControls = $this.GetSessionControls($Cap) $CapDetails = [pscustomobject]@{ "Name" = $Cap.DisplayName; "State" = $State; "Users" = $Users "Apps/Actions" = $Apps; "Conditions" = $Conditions; "Block/Grant Access" = $AccessControls; "Session Controls" = $SessionControls; } $Table += $CapDetails } $CapTableJson = ConvertTo-Json $Table return $CapTableJson } } function Get-CapTracker { [CapHelper]::New() } # SIG # Begin signature block # MIIuwAYJKoZIhvcNAQcCoIIusTCCLq0CAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCCxpri0kvAHU+vp # mZydMXROEijdGbuDwFxBVxXxPe2doaCCE6MwggWQMIIDeKADAgECAhAFmxtXno4h # MuI5B72nd3VcMA0GCSqGSIb3DQEBDAUAMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQK # EwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNV # BAMTGERpZ2lDZXJ0IFRydXN0ZWQgUm9vdCBHNDAeFw0xMzA4MDExMjAwMDBaFw0z # ODAxMTUxMjAwMDBaMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJ # bmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0 # IFRydXN0ZWQgUm9vdCBHNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIB # AL/mkHNo3rvkXUo8MCIwaTPswqclLskhPfKK2FnC4SmnPVirdprNrnsbhA3EMB/z # G6Q4FutWxpdtHauyefLKEdLkX9YFPFIPUh/GnhWlfr6fqVcWWVVyr2iTcMKyunWZ # anMylNEQRBAu34LzB4TmdDttceItDBvuINXJIB1jKS3O7F5OyJP4IWGbNOsFxl7s # Wxq868nPzaw0QF+xembud8hIqGZXV59UWI4MK7dPpzDZVu7Ke13jrclPXuU15zHL # 2pNe3I6PgNq2kZhAkHnDeMe2scS1ahg4AxCN2NQ3pC4FfYj1gj4QkXCrVYJBMtfb # BHMqbpEBfCFM1LyuGwN1XXhm2ToxRJozQL8I11pJpMLmqaBn3aQnvKFPObURWBf3 # JFxGj2T3wWmIdph2PVldQnaHiZdpekjw4KISG2aadMreSx7nDmOu5tTvkpI6nj3c # AORFJYm2mkQZK37AlLTSYW3rM9nF30sEAMx9HJXDj/chsrIRt7t/8tWMcCxBYKqx # YxhElRp2Yn72gLD76GSmM9GJB+G9t+ZDpBi4pncB4Q+UDCEdslQpJYls5Q5SUUd0 # viastkF13nqsX40/ybzTQRESW+UQUOsxxcpyFiIJ33xMdT9j7CFfxCBRa2+xq4aL # T8LWRV+dIPyhHsXAj6KxfgommfXkaS+YHS312amyHeUbAgMBAAGjQjBAMA8GA1Ud # EwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMB0GA1UdDgQWBBTs1+OC0nFdZEzf # Lmc/57qYrhwPTzANBgkqhkiG9w0BAQwFAAOCAgEAu2HZfalsvhfEkRvDoaIAjeNk # aA9Wz3eucPn9mkqZucl4XAwMX+TmFClWCzZJXURj4K2clhhmGyMNPXnpbWvWVPjS # PMFDQK4dUPVS/JA7u5iZaWvHwaeoaKQn3J35J64whbn2Z006Po9ZOSJTROvIXQPK # 7VB6fWIhCoDIc2bRoAVgX+iltKevqPdtNZx8WorWojiZ83iL9E3SIAveBO6Mm0eB # cg3AFDLvMFkuruBx8lbkapdvklBtlo1oepqyNhR6BvIkuQkRUNcIsbiJeoQjYUIp # 5aPNoiBB19GcZNnqJqGLFNdMGbJQQXE9P01wI4YMStyB0swylIQNCAmXHE/A7msg # dDDS4Dk0EIUhFQEI6FUy3nFJ2SgXUE3mvk3RdazQyvtBuEOlqtPDBURPLDab4vri # RbgjU2wGb2dVf0a1TD9uKFp5JtKkqGKX0h7i7UqLvBv9R0oN32dmfrJbQdA75PQ7 # 9ARj6e/CVABRoIoqyc54zNXqhwQYs86vSYiv85KZtrPmYQ/ShQDnUBrkG5WdGaG5 # nLGbsQAe79APT0JsyQq87kP6OnGlyE0mpTX9iV28hWIdMtKgK1TtmlfB2/oQzxm3 # i0objwG2J5VT6LaJbVu8aNQj6ItRolb58KaAoNYes7wPD1N1KarqE3fk3oyBIa0H # EEcRrYc9B9F1vM/zZn4wggawMIIEmKADAgECAhAIrUCyYNKcTJ9ezam9k67ZMA0G # CSqGSIb3DQEBDAUAMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJ # bmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lDZXJ0 # IFRydXN0ZWQgUm9vdCBHNDAeFw0yMTA0MjkwMDAwMDBaFw0zNjA0MjgyMzU5NTla # MGkxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjFBMD8GA1UE # AxM4RGlnaUNlcnQgVHJ1c3RlZCBHNCBDb2RlIFNpZ25pbmcgUlNBNDA5NiBTSEEz # ODQgMjAyMSBDQTEwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDVtC9C # 0CiteLdd1TlZG7GIQvUzjOs9gZdwxbvEhSYwn6SOaNhc9es0JAfhS0/TeEP0F9ce # 2vnS1WcaUk8OoVf8iJnBkcyBAz5NcCRks43iCH00fUyAVxJrQ5qZ8sU7H/Lvy0da # E6ZMswEgJfMQ04uy+wjwiuCdCcBlp/qYgEk1hz1RGeiQIXhFLqGfLOEYwhrMxe6T # SXBCMo/7xuoc82VokaJNTIIRSFJo3hC9FFdd6BgTZcV/sk+FLEikVoQ11vkunKoA # FdE3/hoGlMJ8yOobMubKwvSnowMOdKWvObarYBLj6Na59zHh3K3kGKDYwSNHR7Oh # D26jq22YBoMbt2pnLdK9RBqSEIGPsDsJ18ebMlrC/2pgVItJwZPt4bRc4G/rJvmM # 1bL5OBDm6s6R9b7T+2+TYTRcvJNFKIM2KmYoX7BzzosmJQayg9Rc9hUZTO1i4F4z # 8ujo7AqnsAMrkbI2eb73rQgedaZlzLvjSFDzd5Ea/ttQokbIYViY9XwCFjyDKK05 # huzUtw1T0PhH5nUwjewwk3YUpltLXXRhTT8SkXbev1jLchApQfDVxW0mdmgRQRNY # mtwmKwH0iU1Z23jPgUo+QEdfyYFQc4UQIyFZYIpkVMHMIRroOBl8ZhzNeDhFMJlP # /2NPTLuqDQhTQXxYPUez+rbsjDIJAsxsPAxWEQIDAQABo4IBWTCCAVUwEgYDVR0T # AQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHwYD # VR0jBBgwFoAU7NfjgtJxXWRM3y5nP+e6mK4cD08wDgYDVR0PAQH/BAQDAgGGMBMG # A1UdJQQMMAoGCCsGAQUFBwMDMHcGCCsGAQUFBwEBBGswaTAkBggrBgEFBQcwAYYY # aHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEEGCCsGAQUFBzAChjVodHRwOi8vY2Fj # ZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNydDBDBgNV # HR8EPDA6MDigNqA0hjJodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRU # cnVzdGVkUm9vdEc0LmNybDAcBgNVHSAEFTATMAcGBWeBDAEDMAgGBmeBDAEEATAN # BgkqhkiG9w0BAQwFAAOCAgEAOiNEPY0Idu6PvDqZ01bgAhql+Eg08yy25nRm95Ry # sQDKr2wwJxMSnpBEn0v9nqN8JtU3vDpdSG2V1T9J9Ce7FoFFUP2cvbaF4HZ+N3HL # IvdaqpDP9ZNq4+sg0dVQeYiaiorBtr2hSBh+3NiAGhEZGM1hmYFW9snjdufE5Btf # Q/g+lP92OT2e1JnPSt0o618moZVYSNUa/tcnP/2Q0XaG3RywYFzzDaju4ImhvTnh # OE7abrs2nfvlIVNaw8rpavGiPttDuDPITzgUkpn13c5UbdldAhQfQDN8A+KVssIh # dXNSy0bYxDQcoqVLjc1vdjcshT8azibpGL6QB7BDf5WIIIJw8MzK7/0pNVwfiThV # 9zeKiwmhywvpMRr/LhlcOXHhvpynCgbWJme3kuZOX956rEnPLqR0kq3bPKSchh/j # wVYbKyP/j7XqiHtwa+aguv06P0WmxOgWkVKLQcBIhEuWTatEQOON8BUozu3xGFYH # Ki8QxAwIZDwzj64ojDzLj4gLDb879M4ee47vtevLt/B3E+bnKD+sEq6lLyJsQfmC # XBVmzGwOysWGw/YmMwwHS6DTBwJqakAwSEs0qFEgu60bhQjiWQ1tygVQK+pKHJ6l # /aCnHwZ05/LWUpD9r4VIIflXO7ScA+2GRfS0YW6/aOImYIbqyK+p/pQd52MbOoZW # eE4wggdXMIIFP6ADAgECAhANkQ8dPvvR0q3Ytt4H0T3aMA0GCSqGSIb3DQEBCwUA # MGkxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjFBMD8GA1UE # AxM4RGlnaUNlcnQgVHJ1c3RlZCBHNCBDb2RlIFNpZ25pbmcgUlNBNDA5NiBTSEEz # ODQgMjAyMSBDQTEwHhcNMjQwMTMwMDAwMDAwWhcNMjUwMTI5MjM1OTU5WjBfMQsw # CQYDVQQGEwJVUzEdMBsGA1UECBMURGlzdHJpY3Qgb2YgQ29sdW1iaWExEzARBgNV # BAcTCldhc2hpbmd0b24xDTALBgNVBAoTBENJU0ExDTALBgNVBAMTBENJU0EwggIi # MA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCT1y7uJCQax8JfiDEYgpiU9URj # EXCTRqtZbDALM9rPUudiuM3mj6A1SUSAAWYv6DTsvGPvxyMI2Idg0mQunl4Ms9DJ # yVwe5k4+Anj/73Nx1AbOPYP8xRZcD10FkctKGhV0PzvrDcwU15hsQWtiepFgg+bX # fHkGMeu426oc69f43vKE43DiqKTf0/UBX/qgpj3JZvJ3zc1kilBOv4sBCksfCjbW # tLZD0tqAgBsNPo3Oy5mQG31E1eZdTNvrdTnEXacSwb3k615z7mHy7nqBUkOruZ9E # tnvC2qla+uL3ks91O/e/LnKzH9Lj1JmEBf6jwPN/MYR9Dymni4Mi3AQ8mpQMyFmi # XcSHymibSNbtTMavpdBWjFfrcvPETX7krROUOoLzMQmNgHArceSh55tgvDRdSU5c # WK3BTvK3l3mgCdgjre7XGYxV3W8apyxk5+RKfHdbv9cpRwpSuDnI8sHeqmB3fnfo # Cr1PPu4WhKegt20CobhDVybiBdhDVqUdR53ful4N/coQOEHDrIExB5nJf9Pvdrza # DyIGKAMIXD79ba5/rQEo+2cA66oJkPlvB5hEGI/jtDcYwDBgalbwB7Kc8zAAhl6+ # JvHfYpXOkppSfEQbaRXZI+LGXWQAFa5pJDfDEAyZSXprStgw594sWUOysp+UOxFe # kSA4mBr0o1jVpdaulwIDAQABo4ICAzCCAf8wHwYDVR0jBBgwFoAUaDfg67Y7+F8R # hvv+YXsIiGX0TkIwHQYDVR0OBBYEFAmyTB5bcWyA+8+rq540jPRLJ1nYMD4GA1Ud # IAQ3MDUwMwYGZ4EMAQQBMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNl # cnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMw # gbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0Rp # Z2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5j # cmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0 # ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMIGUBggrBgEF # BQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29t # MFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNl # cnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNydDAJ # BgNVHRMEAjAAMA0GCSqGSIb3DQEBCwUAA4ICAQAh2Jnt9IPoBvOQlYQUlCP9iJ5y # XAvEWe1camOwedqMZsHEPpT2yd6+fMzPZmV3/bYJgaN2OrDS1snf62S7yc+AulVw # PAXSp1lSAiFEbZ6PFEdEBIag9B65Mp/cvRtJsIWQIc//jWqFMHpkU6r3MW9YARRu # vaIf5/0qlM4VEwn3lTf+jJdxhhyoOFTWWd3BrlMPcT06z6F6hFfyycQkZ3Y9wEJ3 # uOU9bCNLZL1HCjlKT+oI0WsgeRdbe2sYrnvv9NmDY9oEi8PEq+DGjiTgLbY5OcAX # uUogPPw6gbcuNn8Hq6FFKPIQxaksB8dF8Gw4m2lQoUWESPRF8Zaq9lmZN3+QzA79 # yskfJtAFqz3gUP5wJBdNfi/u1sGbLI0QnJQkIKfFuz7DfDPldw0gIl05BIYwZBmj # TpFRu1/+gIlP1Ul4L/wt9Lxk6pglObLsdxHP2UQrG30JaUN0gv3xZMBBByHGVVTe # cyU4qwJ0ulMdv/kjHwh+m58uOF8gHXLfyBmOjYpohN3+l0rS0qdArZMNSmLTA7N8 # n3V3AZLKB//1yhPt++gR4pCFdXmgwYDDLRxjlV0cMsG1UeSQUdI0aieh/grg5TQO # CergVXS5h3sz5U0ZQPWND41LJhA0gF2OGZNHdUc9+0dwTsfxAERrjaTdeZp0/rdZ # 9iGBoiRsS4U86S8xkDGCGnMwghpvAgEBMH0waTELMAkGA1UEBhMCVVMxFzAVBgNV # BAoTDkRpZ2lDZXJ0LCBJbmMuMUEwPwYDVQQDEzhEaWdpQ2VydCBUcnVzdGVkIEc0 # IENvZGUgU2lnbmluZyBSU0E0MDk2IFNIQTM4NCAyMDIxIENBMQIQDZEPHT770dKt # 2LbeB9E92jANBglghkgBZQMEAgEFAKCBhDAYBgorBgEEAYI3AgEMMQowCKACgACh # AoAAMBkGCSqGSIb3DQEJAzEMBgorBgEEAYI3AgEEMBwGCisGAQQBgjcCAQsxDjAM # BgorBgEEAYI3AgEVMC8GCSqGSIb3DQEJBDEiBCChypn83Rl9rEsRURMtReivWo0Z # VdDJtGZVAViiPH2CUTANBgkqhkiG9w0BAQEFAASCAgATEwgWsl0YxZiNo4S5m0c4 # FNj/DcII0r4RtDqUE54GsLDcGTTS0MXd3+1Hr9fz7Mr4ny58/vuDG5It83BTR6OS # Q3Xao0u4A7xZ3jXW4b8vGUpSZjyEkUcDzLAnxMmmxAjWlog0pz9VOHudOnbwQ4kd # GTJj037KrpsBLlMg7EqxEn9ASKlwqOabulMUE7KKO6/SZOFW823vKWoGMOiJpDHS # wUl6FV3yZn7IHiROx+V/WDm2to9uhMNIwPqMC4Y3QeqZI4xvMdFrQFtLI93jo/Lm # n9m5r2LGIqfeCkWtFOUem23FmNj+iWXW6Cw0AVLWO533HL89hKH7W+WJ/4ntkptz # yHzQ0jzN6YTZN0qVhgNCZucQdKhiBX/YlCgYYHi5nUa4xMlCuK1VWDF9Y8c+SDWi # vkkGAWelSzW/8Lr7TjbvJ2MYamBrN489/0kkErnAJViNZ8YO6Rz0VYmC6EHrQRkr # ifPU9lGZ7qDl7L6hu/wpzXX76cue/WG+UzTm7FFIbHXYfGzRpAF9g13gvNmTnHE/ # C0ljiXTyeYT42jaGffGTNQbxEL7rCB6Tuv3ze2f1MrsuMjEOftEzPINz+qmkM00+ # bwFENmr5PrVgHF+/RJQiuyvyfWKx9ZGfD5d6nlNYMAbHVqWmBRY4NPUkDWIBbOnc # /3DiUhjhi7N5Usr64tDEgaGCF0Awghc8BgorBgEEAYI3AwMBMYIXLDCCFygGCSqG # SIb3DQEHAqCCFxkwghcVAgEDMQ8wDQYJYIZIAWUDBAIBBQAweAYLKoZIhvcNAQkQ # AQSgaQRnMGUCAQEGCWCGSAGG/WwHATAxMA0GCWCGSAFlAwQCAQUABCCbkGC4Z0N1 # gwMqOszh4W6vcdyfrs82OcpcIG8mpzHvlAIRANo8PGuwFaeG+qbUhMTrULwYDzIw # MjQwODEyMTU1MDIzWqCCEwkwggbCMIIEqqADAgECAhAFRK/zlJ0IOaa/2z9f5WEW # MA0GCSqGSIb3DQEBCwUAMGMxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2Vy # dCwgSW5jLjE7MDkGA1UEAxMyRGlnaUNlcnQgVHJ1c3RlZCBHNCBSU0E0MDk2IFNI # QTI1NiBUaW1lU3RhbXBpbmcgQ0EwHhcNMjMwNzE0MDAwMDAwWhcNMzQxMDEzMjM1 # OTU5WjBIMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xIDAe # BgNVBAMTF0RpZ2lDZXJ0IFRpbWVzdGFtcCAyMDIzMIICIjANBgkqhkiG9w0BAQEF # AAOCAg8AMIICCgKCAgEAo1NFhx2DjlusPlSzI+DPn9fl0uddoQ4J3C9Io5d6Oyqc # Z9xiFVjBqZMRp82qsmrdECmKHmJjadNYnDVxvzqX65RQjxwg6seaOy+WZuNp52n+ # W8PWKyAcwZeUtKVQgfLPywemMGjKg0La/H8JJJSkghraarrYO8pd3hkYhftF6g1h # bJ3+cV7EBpo88MUueQ8bZlLjyNY+X9pD04T10Mf2SC1eRXWWdf7dEKEbg8G45lKV # tUfXeCk5a+B4WZfjRCtK1ZXO7wgX6oJkTf8j48qG7rSkIWRw69XloNpjsy7pBe6q # 9iT1HbybHLK3X9/w7nZ9MZllR1WdSiQvrCuXvp/k/XtzPjLuUjT71Lvr1KAsNJvj # 3m5kGQc3AZEPHLVRzapMZoOIaGK7vEEbeBlt5NkP4FhB+9ixLOFRr7StFQYU6mII # E9NpHnxkTZ0P387RXoyqq1AVybPKvNfEO2hEo6U7Qv1zfe7dCv95NBB+plwKWEwA # PoVpdceDZNZ1zY8SdlalJPrXxGshuugfNJgvOuprAbD3+yqG7HtSOKmYCaFxsmxx # rz64b5bV4RAT/mFHCoz+8LbH1cfebCTwv0KCyqBxPZySkwS0aXAnDU+3tTbRyV8I # pHCj7ArxES5k4MsiK8rxKBMhSVF+BmbTO77665E42FEHypS34lCh8zrTioPLQHsC # AwEAAaOCAYswggGHMA4GA1UdDwEB/wQEAwIHgDAMBgNVHRMBAf8EAjAAMBYGA1Ud # JQEB/wQMMAoGCCsGAQUFBwMIMCAGA1UdIAQZMBcwCAYGZ4EMAQQCMAsGCWCGSAGG # /WwHATAfBgNVHSMEGDAWgBS6FtltTYUvcyl2mi91jGogj57IbzAdBgNVHQ4EFgQU # pbbvE+fvzdBkodVWqWUxo97V40kwWgYDVR0fBFMwUTBPoE2gS4ZJaHR0cDovL2Ny # bDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0UlNBNDA5NlNIQTI1NlRp # bWVTdGFtcGluZ0NBLmNybDCBkAYIKwYBBQUHAQEEgYMwgYAwJAYIKwYBBQUHMAGG # GGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBYBggrBgEFBQcwAoZMaHR0cDovL2Nh # Y2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0UlNBNDA5NlNIQTI1 # NlRpbWVTdGFtcGluZ0NBLmNydDANBgkqhkiG9w0BAQsFAAOCAgEAgRrW3qCptZgX # vHCNT4o8aJzYJf/LLOTN6l0ikuyMIgKpuM+AqNnn48XtJoKKcS8Y3U623mzX4WCc # K+3tPUiOuGu6fF29wmE3aEl3o+uQqhLXJ4Xzjh6S2sJAOJ9dyKAuJXglnSoFeoQp # mLZXeY/bJlYrsPOnvTcM2Jh2T1a5UsK2nTipgedtQVyMadG5K8TGe8+c+njikxp2 # oml101DkRBK+IA2eqUTQ+OVJdwhaIcW0z5iVGlS6ubzBaRm6zxbygzc0brBBJt3e # WpdPM43UjXd9dUWhpVgmagNF3tlQtVCMr1a9TMXhRsUo063nQwBw3syYnhmJA+rU # kTfvTVLzyWAhxFZH7doRS4wyw4jmWOK22z75X7BC1o/jF5HRqsBV44a/rCcsQdCa # M0qoNtS5cpZ+l3k4SF/Kwtw9Mt911jZnWon49qfH5U81PAC9vpwqbHkB3NpE5jre # ODsHXjlY9HxzMVWggBHLFAx+rrz+pOt5Zapo1iLKO+uagjVXKBbLafIymrLS2Dq4 # sUaGa7oX/cR3bBVsrquvczroSUa31X/MtjjA2Owc9bahuEMs305MfR5ocMB3CtQC # 4Fxguyj/OOVSWtasFyIjTvTs0xf7UGv/B3cfcZdEQcm4RtNsMnxYL2dHZeUbc7aZ # +WssBkbvQR7w8F/g29mtkIBEr4AQQYowggauMIIElqADAgECAhAHNje3JFR82Ees # /ShmKl5bMA0GCSqGSIb3DQEBCwUAMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxE # aWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMT # GERpZ2lDZXJ0IFRydXN0ZWQgUm9vdCBHNDAeFw0yMjAzMjMwMDAwMDBaFw0zNzAz # MjIyMzU5NTlaMGMxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5j # LjE7MDkGA1UEAxMyRGlnaUNlcnQgVHJ1c3RlZCBHNCBSU0E0MDk2IFNIQTI1NiBU # aW1lU3RhbXBpbmcgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDG # hjUGSbPBPXJJUVXHJQPE8pE3qZdRodbSg9GeTKJtoLDMg/la9hGhRBVCX6SI82j6 # ffOciQt/nR+eDzMfUBMLJnOWbfhXqAJ9/UO0hNoR8XOxs+4rgISKIhjf69o9xBd/ # qxkrPkLcZ47qUT3w1lbU5ygt69OxtXXnHwZljZQp09nsad/ZkIdGAHvbREGJ3Hxq # V3rwN3mfXazL6IRktFLydkf3YYMZ3V+0VAshaG43IbtArF+y3kp9zvU5EmfvDqVj # bOSmxR3NNg1c1eYbqMFkdECnwHLFuk4fsbVYTXn+149zk6wsOeKlSNbwsDETqVcp # licu9Yemj052FVUmcJgmf6AaRyBD40NjgHt1biclkJg6OBGz9vae5jtb7IHeIhTZ # girHkr+g3uM+onP65x9abJTyUpURK1h0QCirc0PO30qhHGs4xSnzyqqWc0Jon7ZG # s506o9UD4L/wojzKQtwYSH8UNM/STKvvmz3+DrhkKvp1KCRB7UK/BZxmSVJQ9FHz # NklNiyDSLFc1eSuo80VgvCONWPfcYd6T/jnA+bIwpUzX6ZhKWD7TA4j+s4/TXkt2 # ElGTyYwMO1uKIqjBJgj5FBASA31fI7tk42PgpuE+9sJ0sj8eCXbsq11GdeJgo1gJ # ASgADoRU7s7pXcheMBK9Rp6103a50g5rmQzSM7TNsQIDAQABo4IBXTCCAVkwEgYD # VR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQUuhbZbU2FL3MpdpovdYxqII+eyG8w # HwYDVR0jBBgwFoAU7NfjgtJxXWRM3y5nP+e6mK4cD08wDgYDVR0PAQH/BAQDAgGG # MBMGA1UdJQQMMAoGCCsGAQUFBwMIMHcGCCsGAQUFBwEBBGswaTAkBggrBgEFBQcw # AYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEEGCCsGAQUFBzAChjVodHRwOi8v # Y2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNydDBD # BgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNl # cnRUcnVzdGVkUm9vdEc0LmNybDAgBgNVHSAEGTAXMAgGBmeBDAEEAjALBglghkgB # hv1sBwEwDQYJKoZIhvcNAQELBQADggIBAH1ZjsCTtm+YqUQiAX5m1tghQuGwGC4Q # TRPPMFPOvxj7x1Bd4ksp+3CKDaopafxpwc8dB+k+YMjYC+VcW9dth/qEICU0MWfN # thKWb8RQTGIdDAiCqBa9qVbPFXONASIlzpVpP0d3+3J0FNf/q0+KLHqrhc1DX+1g # tqpPkWaeLJ7giqzl/Yy8ZCaHbJK9nXzQcAp876i8dU+6WvepELJd6f8oVInw1Ypx # dmXazPByoyP6wCeCRK6ZJxurJB4mwbfeKuv2nrF5mYGjVoarCkXJ38SNoOeY+/um # nXKvxMfBwWpx2cYTgAnEtp/Nh4cku0+jSbl3ZpHxcpzpSwJSpzd+k1OsOx0ISQ+U # zTl63f8lY5knLD0/a6fxZsNBzU+2QJshIUDQtxMkzdwdeDrknq3lNHGS1yZr5Dhz # q6YBT70/O3itTK37xJV77QpfMzmHQXh6OOmc4d0j/R0o08f56PGYX/sr2H7yRp11 # LB4nLCbbbxV7HhmLNriT1ObyF5lZynDwN7+YAN8gFk8n+2BnFqFmut1VwDophrCY # oCvtlUG3OtUVmDG0YgkPCr2B2RP+v6TR81fZvAT6gt4y3wSJ8ADNXcL50CN/AAvk # dgIm2fBldkKmKYcJRyvmfxqkhQ/8mJb2VVQrH4D6wPIOK+XW+6kvRBVK5xMOHds3 # OBqhK/bt1nz8MIIFjTCCBHWgAwIBAgIQDpsYjvnQLefv21DiCEAYWjANBgkqhkiG # 9w0BAQwFADBlMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkw # FwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSQwIgYDVQQDExtEaWdpQ2VydCBBc3N1 # cmVkIElEIFJvb3QgQ0EwHhcNMjIwODAxMDAwMDAwWhcNMzExMTA5MjM1OTU5WjBi # MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3 # d3cuZGlnaWNlcnQuY29tMSEwHwYDVQQDExhEaWdpQ2VydCBUcnVzdGVkIFJvb3Qg # RzQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC/5pBzaN675F1KPDAi # MGkz7MKnJS7JIT3yithZwuEppz1Yq3aaza57G4QNxDAf8xukOBbrVsaXbR2rsnny # yhHS5F/WBTxSD1Ifxp4VpX6+n6lXFllVcq9ok3DCsrp1mWpzMpTREEQQLt+C8weE # 5nQ7bXHiLQwb7iDVySAdYyktzuxeTsiT+CFhmzTrBcZe7FsavOvJz82sNEBfsXpm # 7nfISKhmV1efVFiODCu3T6cw2Vbuyntd463JT17lNecxy9qTXtyOj4DatpGYQJB5 # w3jHtrHEtWoYOAMQjdjUN6QuBX2I9YI+EJFwq1WCQTLX2wRzKm6RAXwhTNS8rhsD # dV14Ztk6MUSaM0C/CNdaSaTC5qmgZ92kJ7yhTzm1EVgX9yRcRo9k98FpiHaYdj1Z # XUJ2h4mXaXpI8OCiEhtmmnTK3kse5w5jrubU75KSOp493ADkRSWJtppEGSt+wJS0 # 0mFt6zPZxd9LBADMfRyVw4/3IbKyEbe7f/LVjHAsQWCqsWMYRJUadmJ+9oCw++hk # pjPRiQfhvbfmQ6QYuKZ3AeEPlAwhHbJUKSWJbOUOUlFHdL4mrLZBdd56rF+NP8m8 # 00ERElvlEFDrMcXKchYiCd98THU/Y+whX8QgUWtvsauGi0/C1kVfnSD8oR7FwI+i # sX4KJpn15GkvmB0t9dmpsh3lGwIDAQABo4IBOjCCATYwDwYDVR0TAQH/BAUwAwEB # /zAdBgNVHQ4EFgQU7NfjgtJxXWRM3y5nP+e6mK4cD08wHwYDVR0jBBgwFoAUReui # r/SSy4IxLVGLp6chnfNtyA8wDgYDVR0PAQH/BAQDAgGGMHkGCCsGAQUFBwEBBG0w # azAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMEMGCCsGAQUF # BzAChjdodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRBc3N1cmVk # SURSb290Q0EuY3J0MEUGA1UdHwQ+MDwwOqA4oDaGNGh0dHA6Ly9jcmwzLmRpZ2lj # ZXJ0LmNvbS9EaWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcmwwEQYDVR0gBAowCDAG # BgRVHSAAMA0GCSqGSIb3DQEBDAUAA4IBAQBwoL9DXFXnOF+go3QbPbYW1/e/Vwe9 # mqyhhyzshV6pGrsi+IcaaVQi7aSId229GhT0E0p6Ly23OO/0/4C5+KH38nLeJLxS # A8hO0Cre+i1Wz/n096wwepqLsl7Uz9FDRJtDIeuWcqFItJnLnU+nBgMTdydE1Od/ # 6Fmo8L8vC6bp8jQ87PcDx4eo0kxAGTVGamlUsLihVo7spNU96LHc/RzY9HdaXFSM # b++hUD38dglohJ9vytsgjTVgHAIDyyCwrFigDkBjxZgiwbJZ9VVrzyerbHbObyMt # 9H5xaiNrIv8SuFQtJ37YOtnwtoeW/VvRXKwYw02fc7cBqZ9Xql4o4rmUMYIDdjCC # A3ICAQEwdzBjMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4x # OzA5BgNVBAMTMkRpZ2lDZXJ0IFRydXN0ZWQgRzQgUlNBNDA5NiBTSEEyNTYgVGlt # ZVN0YW1waW5nIENBAhAFRK/zlJ0IOaa/2z9f5WEWMA0GCWCGSAFlAwQCAQUAoIHR # MBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAcBgkqhkiG9w0BCQUxDxcNMjQw # ODEyMTU1MDIzWjArBgsqhkiG9w0BCRACDDEcMBowGDAWBBRm8CsywsLJD4JdzqqK # ycZPGZzPQDAvBgkqhkiG9w0BCQQxIgQgBgc3Ms2RFVNb913qCij5woZhbO4t6ncP # 2VTb8+e9xx8wNwYLKoZIhvcNAQkQAi8xKDAmMCQwIgQg0vbkbe10IszR1EBXaEE2 # b4KK2lWarjMWr00amtQMeCgwDQYJKoZIhvcNAQEBBQAEggIAa1nFQqndEAFwPBc1 # oS7ukAm1mJ14mplQXWSmTq1/bBwYOhNvQu7ysSf6ICIGZ3cjYayJs15X3SS+Uoac # bt2vUOjMM6IRG10M3NqYyNash7bttX/ak5+OMBGAS4exYw8NC+pvr0BuFriYwtpb # WLxh9CnEhkt8jRwUxIwCtaObmfKA41y+VuaDntWwjkix23VqZlFPibVrLM7KbkyV # 3oEcPsorm3HMMhzFiuxUmr1H4XwcjNoY6UqCW2TggXwhG3UEXMvl4yJF/+sNhzPR # YxnLia9sy6C3rbxEpyjVfl7ZbXgI5wsYAVXLg0fBAlmEzn0GHsPBRybCISc64Gs9 # 2Z/+o8cUpUvLm3FE8cbQkVTopxs8p8/TTz1+uSRfHFFe4fcO19KBnt5QVR1H7SnZ # 7mwuAnIH/QiAwu8IFR5GO+u9vRnVVKcxesYPTm9QCHCGKkUWQfiHnK9d1puCm5/8 # R9yeAd3XvZjpwT1bRHhz+YIGNF9dLxh9Vr2iF4pmmmS+Kxa7kbl3Z/SmqILFAp8l # ICLwcOZ1T/SgdhXgf85/E32fCyJNT5NeHVU3S1c4xpponKeLbLDEcnP+mbAy3UPy # S9hMTM9pSFhzlHsbrlOwYfxnUG6oBpYpn344rCXnurxDWCMwOj90L6V6GobyKxb/ # kLjQEOP3ltvr9c9ss3RutNqEEEU= # SIG # End signature block |