[CmdletBinding()]
Param(
    [Parameter(Mandatory=$True,ParameterSetName='Execution')][String]$ForestName,
    [Parameter(Mandatory=$True,ParameterSetName='Execution')][String[]]$DomainNames,
    [Parameter(Mandatory=$False,ParameterSetName='Execution')]$StartAttackWindow,
    [Parameter(Mandatory=$False,ParameterSetName='Execution')]$EndAttackWindow,
    [Parameter(ParameterSetName='Metadata',Mandatory)][switch]$Metadata
)

$Global:self = @{
    ID = 155
    UUID = '66ee675e-4b5d-47a9-a364-a4477c1e73e5'
    Version = '1.0.37966'
    CategoryID = 3
    ShortName = 'SI000155'
    Name = 'SMBv1 is enabled on Domain Controllers'
    ScriptName = 'SMBv1EnabledOnDCs'
    Description = 'This indicator looks for domain controllers where SMBv1 protocol is enabled.'
    Weight = 8
    Severity = 'Critical'
    
    LikelihoodOfCompromise = 'SMBv1 is an old protocol, considered unsafe and susceptible to all kinds of attacks. It was publicly deprecated by Microsoft in 2014.'
    ResultMessage = ''
    Remediation = 'Microsoft recommends to disable SMBv1 whenever possible on both client and server side. Do note, before disabling SMBv1 and to avoid additional errors, make sure best practices are followed regarding the usage of deprecated OS (Windows 2000, 2003, XP, CE), network printers using SMBv1 scan2shares functionalities, or software accessing Windows share with a custom implementation relying on SMBv1. <br>Read more <a href="https://techcommunity.microsoft.com/t5/storage-at-microsoft/stop-using-smb1/ba-p/425858" target="_blank">here.</a></br>'
    Types = @('IoE')
    DataSources = @('AD.LDAP')
    Targets = @('AD')
    Permissions = @()
    SecurityFrameworks = @(
        @{ Name = 'MITRE ATT&CK'; Tags = @('Privilege Escalation', 'Credential Access') }
    )
    Products = @(
        @{ Name = 'DSP'; MinVersion = '3.5'; MaxVersion = '10'; Licenses = @('DSP-I') },
        @{ Name = 'PK'; MinVersion = '1.4'; MaxVersion = '10'; Licenses = @('Community', 'Post-Breach') }
    )
    Selected = 1
}
if($Metadata){ return $self | ConvertTo-Json -Depth 8 -Compress }

Import-Module -Name Semperis-Lib

$code = @"
using System;
using System.Collections.Generic;
using System.Linq;
using System.Net;
using System.Net.Sockets;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading.Tasks;

namespace SmbVersioning
{
    public class SmbVersion
    {
        public struct SMB_ERROR
        {
            public byte ErrorClass;
            public byte Reserved;
            public byte ErrorCode1;
            public byte ErrorCode2;

            public SMB_ERROR(byte errorClass)
            {
                ErrorClass = errorClass;
                Reserved = 0x00;
                ErrorCode1 = 0x00;
                ErrorCode2 = 0x00;
            }
        }

        [Flags]
        public enum Flags
        {
            SMB_FLAGS_LOCK_AND_READ_OK = 0x01,
            SMB_FLAGS_BUF_AVAIL = 0x02,
            Reserved = 0x04,
            SMB_FLAGS_CASE_INSENSITIVE = 0x08,
            SMB_FLAGS_CANONICALIZED_PATHS = 0x10,
            SMB_FLAGS_OPLOCK = 0x20,
            SMB_FLAGS_OPBATCH = 0x40,
            SMB_FLAGS_REPLY = 0x80,

        }

        [Flags]
        public enum Flags2
        {
            SMB_FLAGS2_LONG_NAMES = 0x0001,
            SMB_FLAGS2_EAS = 0x0002,
            SMB_FLAGS2_SMB_SECURITY_SIGNATURE = 0x0004,
            SMB_FLAGS2_IS_LONG_NAME = 0x0040,
            SMB_FLAGS2_DFS = 0x1000,
            SMB_FLAGS2_PAGING_IO = 0x2000,
            SMB_FLAGS2_NT_STATUS = 0x4000,
            SMB_FLAGS2_UNICODE = 0x8000,
        }


        public struct SMB1_HEADER
        {

            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)] public byte[] Protocol; // size 4 bytes // The value is "0xFF+'SMB'".
            public byte Command;
            public SMB_ERROR Status;
            public byte Flags;
            public ushort Flags2;  //Here there are 14 bytes of data which is used differently among different dialects.
            public ushort PIDHigh;
            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)] public byte[] SecurityFeatures; // size 8 bytes a signature in SMB_COM_NEGOTITATE it's 0's
            public ushort Reserved;
            public ushort TID; // A tree identifier
            public ushort PIDLow;
            public ushort UID;
            public ushort MID;
            public SMB1_HEADER(byte command, byte flags, ushort flags2)
            {
                Protocol = new byte[] { 0xFF, 0x53, 0x4D, 0x42 };
                Command = command;
                Status = new SMB_ERROR(0x00);
                Flags = flags;
                Flags2 = flags2;
                PIDHigh = 0x00;
                SecurityFeatures = new byte[] { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
                Reserved = 0x0000;
                Random random = new Random();
                PIDLow = (ushort)random.Next(1 << 16);
                TID = 0x0000;
                UID = 0x0000;
                MID = 0x0001;

            }
        }

        // Reference https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-cifs/25c8c3c9-58fc-4bb8-aa8f-0272dede84c5

        public struct SMB_PARAMETERS
        {
            public byte WordCount;

            public SMB_PARAMETERS(byte wordCount)
            {
                WordCount = wordCount;
            }
        }

        public struct SMB_DATA
        {
            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 2)] public byte[] BytesCount;
            //public byte[] Data; // Dialects maybe change it Dialect

            public SMB_DATA(byte[] bytesCount)
            {
                BytesCount = bytesCount;
                //Data = data;
            }
        }
        public struct Dialect
        {
            public byte BufferFormat;
            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 10)] public byte[] Name;

            public Dialect(byte[] name)
            {
                BufferFormat = 0x02;
                Name = name;
            }
        }

        public struct NetBIOS
        {
            public byte MessageType;
            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 3)] public byte[] Size; // size 3 bytes

            public NetBIOS(byte[] size)
            {
                MessageType = 0x00;
                Size = size;
            }
        }

        [Flags]
        public enum SecurityMode : byte
        {
            NEGOTIATE_USER_SECURITY = 0x01,
            NEGOTIATE_ENCRYPT_PASSWORDS = 0x02,
            NEGOTIATE_SECURITY_SIGNATURES_ENABLED = 0x04,
            NEGOTIATE_SECURITY_SIGNATURES_REQUIRED = 0x08,
        }


        public struct SMB_NEGOTIATE_RESPONSE
        {
            public byte WordCount;
            public ushort SelectedIndex;
            public SecurityMode SecurityMode;
            public ushort MaxMpxCount;
            public ushort MaxVCs;
            public uint MaxBufferSize; // size 4
            public uint MinBufferSize; // size 4
            public uint SessionKey; // size 4
            public uint Capabilities; // size 4
            public string SystemTime; // size 8
            public ushort ServerTimeZone;
            public byte ChallengeLength;
            public ushort ByteCount;
            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)] public byte[] ServerGuid;

            public SMB_NEGOTIATE_RESPONSE(ushort selectedIndex)
            {
                WordCount = 0;
                SelectedIndex = selectedIndex;
                SecurityMode = 0;
                MaxMpxCount = 0;
                MaxVCs = 0;
                MaxBufferSize = 0;
                MinBufferSize = 0;
                SessionKey = 0;
                Capabilities = 0;
                SystemTime = "00000000";
                ServerTimeZone = 0;
                ChallengeLength = 0;
                ByteCount = 0;
                ServerGuid = new byte[] { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36 };
            }

        }

        public struct SMB2_HEADER
        {

            // Always 64 bytes

            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)] public byte[] ProtocolID;
            public ushort HeaderLength;
            public ushort CreditCharge;
            public ushort ChanngelSequence;
            public ushort Reserved;
            public ushort Command;
            public ushort CreditsRequested;
            public uint Flags;
            public uint ChainOffest;
            public ulong MessageID;
            public uint PID;
            public uint TreeID;
            public ulong SessionID;
            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)] public byte[] Signature;

            public SMB2_HEADER(ushort command, uint flags)
            {
                ProtocolID = new byte[] { 0xFE, 0x53, 0x4D, 0x42 };
                HeaderLength = 64;
                CreditCharge = 0;
                ChanngelSequence = 0;
                Reserved = 0;
                Command = command;
                CreditsRequested = 0;
                Flags = flags;
                ChainOffest = 0;
                MessageID = 0;
                PID = 0;
                TreeID = 0;
                SessionID = 0;
                Signature = new byte[] { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36 };
            }

        }

        public struct SMB2_NEGOTIATE_REQUEST
        {
            public ushort StructureSize;
            public ushort DialectCount;
            public ushort SecurityMode;
            public ushort Resereved;
            public uint Capabilities;
            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)] public byte[] ClientGUID;
            public uint NegotiateContextOffset;
            public ushort NegotiateContextCount;
            public ushort Reserved2;

            public SMB2_NEGOTIATE_REQUEST(ushort dialectCount)
            {
                StructureSize = 36;
                DialectCount = dialectCount;
                SecurityMode = 0;
                Resereved = 0;
                Capabilities = 0;
                ClientGUID = new byte[] { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36 };
                NegotiateContextOffset = 0;
                NegotiateContextCount = 0;
                Reserved2 = 0;

            }

        }

        public struct SMB2_Dialect
        {
            public ushort Dialect;

            public SMB2_Dialect(ushort dialect)
            {
                Dialect = dialect;
            }
        }

        [Flags]
        public enum SecurityModeSMB2 : ushort
        {
            SMB2_NEGOTIATE_SIGNING_ENABLED = 0x0001,
            SMB2_NEGOTIATE_SIGNING_REQUIRED = 0x0002,
        }

        public struct SMB2_NEGOTIATE_RESPONSE
        {
            public ushort StructureSize;
            public SecurityModeSMB2 SecurityMode;
            public ushort DialectRevision;
            public ushort NegotiateContextCount;
            [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)] public byte[] ServerGuid;
            public uint Capabilities;
            public uint MaxTransactSize;
            public uint MaxReadSize;
            public uint MaxWriteSize;
            public ulong SystemTime;
            public ulong ServerStartTime;
            public ushort SecurityBufferOffset;
            public ushort SecurityBufferLength;
            public uint NegotiateContextOffset;

            public SMB2_NEGOTIATE_RESPONSE(ushort structureSize)
            {
                StructureSize = 0;
                SecurityMode = 0;
                DialectRevision = 0;
                ServerGuid = new byte[] { 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36 };
                Capabilities = 0;
                MaxTransactSize = 0;
                MaxReadSize = 0;
                MaxWriteSize = 0;
                SystemTime = 0;
                ServerStartTime = 0;
                SecurityBufferOffset = 0;
                SecurityBufferLength = 0;
                NegotiateContextCount = 0;
                NegotiateContextOffset = 0;
            }

        }
        public static byte[] getBytes<T>(T header)
        {

            int size = Marshal.SizeOf(header);
            byte[] arr = new byte[size];

            IntPtr ptr = Marshal.AllocHGlobal(size);
            Marshal.StructureToPtr(header, ptr, true);
            Marshal.Copy(ptr, arr, 0, size);
            Marshal.FreeHGlobal(ptr);
            return arr;
        }
        public static byte[] Combine(byte[] first, byte[] second)
        {
            byte[] ret = new byte[first.Length + second.Length];
            Buffer.BlockCopy(first, 0, ret, 0, first.Length);
            Buffer.BlockCopy(second, 0, ret, first.Length, second.Length);
            return ret;
        }

        public static string BytesCountFromBytes(byte[] bytes_array)
        {
            int decimal_size = bytes_array.Length;
            return String.Format("{0:X2}", decimal_size);
        }

        public static byte[] HexStringToByteArray(string hex)
        {
            return Enumerable.Range(0, hex.Length)
                             .Where(x => x % 2 == 0)
                             .Select(x => Convert.ToByte(hex.Substring(x, 2), 16))
                             .ToArray();
        }
        public static byte[] BuildSMBNegotitateRequest()
        {
            byte[] trailing = { 0x00 };
            byte[] trailing2 = { 0x00, 0x00 };

            SMB1_HEADER SMBh = new SMB1_HEADER(0x72, 0x18, 0x6845);

            byte[] dialectNTBytes = { 0x4e, 0x54, 0x20, 0x4c, 0x4d, 0x20, 0x30, 0x2e, 0x31, 0x32 };
            Dialect dialect = new Dialect(dialectNTBytes);
            byte[] dialectSize = Combine(HexStringToByteArray(BytesCountFromBytes(getBytes(dialect))), trailing);

            SMB_DATA dialects = new SMB_DATA(dialectSize);
            SMB_PARAMETERS smbParameters = new SMB_PARAMETERS(0x00);
            byte[] negotiateProtocolRequest = Combine(getBytes(smbParameters), Combine(getBytes(dialects), Combine(getBytes(dialect), trailing)));
            byte[] smbRequest = Combine(getBytes(SMBh), negotiateProtocolRequest);
            byte[] sizeOfRequest = Combine(trailing2, HexStringToByteArray(BytesCountFromBytes(smbRequest)));

            NetBIOS netBiosh = new NetBIOS(sizeOfRequest);

            byte[] bytesToSend = Combine(getBytes(netBiosh), smbRequest);

            return bytesToSend;

        }
        public static byte[] BuildSMB2NegotitateRequest()
        {
            byte[] trailing2 = { 0x00, 0x00 };

            SMB2_HEADER SMBh = new SMB2_HEADER(0, 0);

            SMB2_Dialect dialect1 = new SMB2_Dialect(0x0202);
            SMB2_Dialect dialect2 = new SMB2_Dialect(0x0210);
            SMB2_Dialect dialect3 = new SMB2_Dialect(0x0300);
            SMB2_Dialect dialect4 = new SMB2_Dialect(0x0302);


            byte[] dialectesBytes = Combine(getBytes(dialect1), Combine(getBytes(dialect2), Combine(getBytes(dialect3), getBytes(dialect4))));
            SMB2_NEGOTIATE_REQUEST negotiateRequest = new SMB2_NEGOTIATE_REQUEST(4);
            byte[] negotiateRequestBytes = Combine(getBytes(negotiateRequest), dialectesBytes);
            byte[] smbRequest = Combine(getBytes(SMBh), negotiateRequestBytes);


            byte[] sizeOfRequest = Combine(trailing2, HexStringToByteArray(BytesCountFromBytes(smbRequest)));

            NetBIOS netBiosh = new NetBIOS(sizeOfRequest);


            byte[] bytesToSend = Combine(getBytes(netBiosh), smbRequest);


            return bytesToSend;

        }
        public static byte ReadByte(byte[] buffer, int offset)
        {
            return buffer[offset];
        }

        public static byte[] ReadBytes(byte[] buffer, int offset, int length)
        {
            byte[] result = new byte[length];
            Array.Copy(buffer, offset, result, 0, length);
            return result;
        }

        public static string GetDialectVersionSMB2(byte[] bytesReceived)
        {
            SMB2_NEGOTIATE_RESPONSE smbResponse = new SMB2_NEGOTIATE_RESPONSE();
            smbResponse.DialectRevision = BitConverter.ToUInt16(bytesReceived, 72);

            if (smbResponse.DialectRevision == 0x302 || smbResponse.DialectRevision == 0x300 || smbResponse.DialectRevision == 0x311)
            {
                return "SMB3";
            }
            else if (smbResponse.DialectRevision == 0x2FF || smbResponse.DialectRevision == 0x202 || smbResponse.DialectRevision == 0x210)
            {
                return "SMB2";
            }
            return "SMB2";
        }

        public static Socket ConnectSocketNew(string server, int port)
        {
            Socket s = null;
            IPHostEntry hostEntry = null;

            // Get host related information.
            hostEntry = Dns.GetHostEntry(server);

            foreach (IPAddress address in hostEntry.AddressList)
            {
                IPEndPoint ipe = new IPEndPoint(address, port);
                Socket tempSocket =
                    new Socket(ipe.AddressFamily, SocketType.Stream, ProtocolType.Tcp);

                tempSocket.Connect(ipe);

                if (tempSocket.Connected)
                {
                    s = tempSocket;
                    break;
                }
                else
                {
                    continue;
                }
            }
            return s;
        }

        public static string ByteArrayToString(byte[] ba)
        {
            StringBuilder hex = new StringBuilder(ba.Length * 2);
            foreach (byte b in ba)
                hex.AppendFormat("{0:x2}", b);
            return hex.ToString();
        }

        public enum SMBVersionType
        {
            SMB1_PROTOCOL,
            SMB2_PROTOCOL,
            VERSION_VALIDATION_FAILED

        }

        public static SMBVersionType CheckAndValidateResponseVersion(byte [] bytesReceived)
        {
            byte [] SMB1_SIGNATURE = new byte[] { 0xFF, 0x53, 0x4D, 0x42 };
            byte [] SMB2_SIGNATURE = new byte[] { 0xFE, 0x53, 0x4D, 0x42 };

            byte [] ProtocolID = ReadBytes(bytesReceived, 4, 4);

            if (SMB1_SIGNATURE.SequenceEqual(ProtocolID))
                return SMBVersionType.SMB1_PROTOCOL;

            if (SMB2_SIGNATURE.SequenceEqual(ProtocolID))
                return SMBVersionType.SMB2_PROTOCOL;

            return SMBVersionType.VERSION_VALIDATION_FAILED;
        }

        public static string CheckInternal(string server, int port)
        {
            SMBVersionType version = SMBVersionType.VERSION_VALIDATION_FAILED;
            int bytes = 0;
            try
            {

                Byte[] bytesSentSMB1 = BuildSMBNegotitateRequest();
                Byte[] bytesReceivedSMB1 = new Byte[512];
                using (Socket socket = ConnectSocketNew(server, port))
                {
                    if (socket == null)
                    {
                        return "Unreachable";
                    }
                    else
                    {
                        socket.ReceiveTimeout = 3000;
                    }


                    socket.Send(bytesSentSMB1, bytesSentSMB1.Length, 0);

                    bytes = socket.Receive(bytesReceivedSMB1, bytesReceivedSMB1.Length, 0);

                    version = CheckAndValidateResponseVersion(bytesReceivedSMB1);
                    if (version == SMBVersionType.SMB1_PROTOCOL)
                    {
                        return "SMB1";
                    }
                    socket.Close();
                }
            }
            catch
            {
                if (bytes == 0)
                {
                    version = SMBVersionType.SMB2_PROTOCOL;
                }

            }
            if (version == SMBVersionType.SMB2_PROTOCOL)
            {
                try
                {
                    Byte[] bytesSentSMB2 = BuildSMB2NegotitateRequest();
                    Byte[] bytesReceivedSMB2 = new Byte[512];
                    using (Socket socket = ConnectSocketNew(server, port))
                    {
                        if (socket == null)
                        {
                            return "Unreachable";
                        }
                        else
                        {
                            socket.ReceiveTimeout = 3000;
                        }

                        // Send request to the server.
                        socket.Send(bytesSentSMB2, bytesSentSMB2.Length, 0);

                        // Receive the server home page content.
                        bytes = 0;

                        // The following will block until the page is transmitted.

                        bytes = socket.Receive(bytesReceivedSMB2, bytesReceivedSMB2.Length, 0);

                        version = CheckAndValidateResponseVersion(bytesReceivedSMB2);
                        if (version == SMBVersionType.SMB2_PROTOCOL)
                        {
                            string dialect = GetDialectVersionSMB2(bytesReceivedSMB2);
                            return dialect;
                        }
                        socket.Close();
                    }
                }
                catch
                {
                    return "Unreachable";
                }
            }
            return "Unrechable";

        }

        public static string[] ResultFromCheckInternal(string host, int port, string DN)
        {
            string[] resultsArray = new string[3];
            resultsArray[0] = host;
            resultsArray[1] = DN;
            resultsArray[2] = CheckInternal(host, port);

            return resultsArray;

        }

        public static Task<string[]> Check(string host, string DN)
        {
            int port = 445;

            return Task.Run(() => ResultFromCheckInternal(host, port, DN));
        }

    }
}

"@


Add-Type -TypeDefinition $code -Language CSharp

# Script Global Variables
$outputObjects = [System.Collections.ArrayList]@()
$domainControllersFailedCount = 0

try {
    $outputObjects = [System.Collections.ArrayList]@()
    $res = New-Object Semperis.PSSecurityIndicatorResult.SecurityIndicatorResult

    $dcs = @()
    foreach ($domain in $DomainNames) {
        $DN = Get-DN $domain
        $dcs += Search-AD -dnsDomain $domain -attributes "dnshostname" -baseDN $DN -scope "Subtree" -filter "(&(objectCategory=computer)(primaryGroupID=516))"

    }

    $tasks = @()

    foreach ($dc in $dcs)
    {
        $dcHostName = $dc.Attributes.dnshostname[$GET_STRING]
        $tasks += [SmbVersioning.SmbVersion]::Check($dcHostName, $dc.DistinguishedName)
    }
    [System.Threading.Tasks.Task]::WhenAll($tasks).Wait()

    foreach ($result in $tasks)
    {
        $resultsArray = $result.Result
        $smbVersion = $resultsArray[2];
        $dcDN = $resultsArray[1]
        $hostName = $resultsArray[0]

        if ($smbVersion -eq "SMB1"){
            $domainControllersFailedCount++
            $thisOutput = [PSCustomObject][Ordered] @{
                DCName = $hostName
                DistinguishedName=$dcDN
                State="SMBv1 is enabled"
            }
            [void]$outputObjects.Add($thisOutput)
        }
        elseif($smbVersion -eq "Unreachable"){
            $domainControllersFailedCount++
            $thisOutput = [PSCustomObject][Ordered] @{
                DCName = $hostName
                DistinguishedName=$dcDN
                State="Unreachable"
            }
            [void]$outputObjects.Add($thisOutput)
        }
    }

    if ($outputObjects.Count -gt 0) {
        $res.ResultObjects = $outputObjects
        $res.Score = 100 - (($domainControllersFailedCount / $dcs.Count) * 100)
        $res.Status = [Semperis.PSSecurityIndicatorResult.ScriptStatus]"Failed"
        $res.ResultMessage = "Found $($domainControllersFailedCount) DCs with SMBv1 Enabled."
        $res.Remediation = "It is highly recommended by Microsoft to disable SMB v1 whenever it is possible on both client and server side. Do note that if you are still not following best practices regarding the usage of deprecated OS (Windows 2000, 2003, XP, CE), regarding Network printer using SMBv1 scan2shares functionalities, or regarding software accessing Windows share with a custom implementation relying on SMB v1, you should consider fixing this issues before disabling SMB v1, as it will generate additional errors."
    }
    else {
        $res.Score = 100
        $res.Status = [Semperis.PSSecurityIndicatorResult.ScriptStatus]"Pass"
        $res.ResultMessage = "No evidence of exposure"
        $res.Remediation = "None"
    }
}
catch {
    return ConvertTo-ErrorResult $_
}
return $res

# SIG # Begin signature block
# MIItlwYJKoZIhvcNAQcCoIItiDCCLYQCAQExDzANBglghkgBZQMEAgEFADB5Bgor
# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG
# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBi0Oh8v8z4Ud7s
# vqrGxa3PoufBjWj99nvqe5mXyxbVraCCJrcwggWNMIIEdaADAgECAhAOmxiO+dAt
# 5+/bUOIIQBhaMA0GCSqGSIb3DQEBDAUAMGUxCzAJBgNVBAYTAlVTMRUwEwYDVQQK
# EwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xJDAiBgNV
# BAMTG0RpZ2lDZXJ0IEFzc3VyZWQgSUQgUm9vdCBDQTAeFw0yMjA4MDEwMDAwMDBa
# Fw0zMTExMDkyMzU5NTlaMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2Vy
# dCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lD
# ZXJ0IFRydXN0ZWQgUm9vdCBHNDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
# ggIBAL/mkHNo3rvkXUo8MCIwaTPswqclLskhPfKK2FnC4SmnPVirdprNrnsbhA3E
# MB/zG6Q4FutWxpdtHauyefLKEdLkX9YFPFIPUh/GnhWlfr6fqVcWWVVyr2iTcMKy
# unWZanMylNEQRBAu34LzB4TmdDttceItDBvuINXJIB1jKS3O7F5OyJP4IWGbNOsF
# xl7sWxq868nPzaw0QF+xembud8hIqGZXV59UWI4MK7dPpzDZVu7Ke13jrclPXuU1
# 5zHL2pNe3I6PgNq2kZhAkHnDeMe2scS1ahg4AxCN2NQ3pC4FfYj1gj4QkXCrVYJB
# MtfbBHMqbpEBfCFM1LyuGwN1XXhm2ToxRJozQL8I11pJpMLmqaBn3aQnvKFPObUR
# WBf3JFxGj2T3wWmIdph2PVldQnaHiZdpekjw4KISG2aadMreSx7nDmOu5tTvkpI6
# nj3cAORFJYm2mkQZK37AlLTSYW3rM9nF30sEAMx9HJXDj/chsrIRt7t/8tWMcCxB
# YKqxYxhElRp2Yn72gLD76GSmM9GJB+G9t+ZDpBi4pncB4Q+UDCEdslQpJYls5Q5S
# UUd0viastkF13nqsX40/ybzTQRESW+UQUOsxxcpyFiIJ33xMdT9j7CFfxCBRa2+x
# q4aLT8LWRV+dIPyhHsXAj6KxfgommfXkaS+YHS312amyHeUbAgMBAAGjggE6MIIB
# NjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTs1+OC0nFdZEzfLmc/57qYrhwP
# TzAfBgNVHSMEGDAWgBRF66Kv9JLLgjEtUYunpyGd823IDzAOBgNVHQ8BAf8EBAMC
# AYYweQYIKwYBBQUHAQEEbTBrMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdp
# Y2VydC5jb20wQwYIKwYBBQUHMAKGN2h0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNv
# bS9EaWdpQ2VydEFzc3VyZWRJRFJvb3RDQS5jcnQwRQYDVR0fBD4wPDA6oDigNoY0
# aHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0QXNzdXJlZElEUm9vdENB
# LmNybDARBgNVHSAECjAIMAYGBFUdIAAwDQYJKoZIhvcNAQEMBQADggEBAHCgv0Nc
# Vec4X6CjdBs9thbX979XB72arKGHLOyFXqkauyL4hxppVCLtpIh3bb0aFPQTSnov
# Lbc47/T/gLn4offyct4kvFIDyE7QKt76LVbP+fT3rDB6mouyXtTP0UNEm0Mh65Zy
# oUi0mcudT6cGAxN3J0TU53/oWajwvy8LpunyNDzs9wPHh6jSTEAZNUZqaVSwuKFW
# juyk1T3osdz9HNj0d1pcVIxv76FQPfx2CWiEn2/K2yCNNWAcAgPLILCsWKAOQGPF
# mCLBsln1VWvPJ6tsds5vIy30fnFqI2si/xK4VC0nftg62fC2h5b9W9FcrBjDTZ9z
# twGpn1eqXijiuZQwggWiMIIEiqADAgECAhB4AxhCRXCKQc9vAbjutKlUMA0GCSqG
# SIb3DQEBDAUAMEwxIDAeBgNVBAsTF0dsb2JhbFNpZ24gUm9vdCBDQSAtIFIzMRMw
# EQYDVQQKEwpHbG9iYWxTaWduMRMwEQYDVQQDEwpHbG9iYWxTaWduMB4XDTIwMDcy
# ODAwMDAwMFoXDTI5MDMxODAwMDAwMFowUzELMAkGA1UEBhMCQkUxGTAXBgNVBAoT
# EEdsb2JhbFNpZ24gbnYtc2ExKTAnBgNVBAMTIEdsb2JhbFNpZ24gQ29kZSBTaWdu
# aW5nIFJvb3QgUjQ1MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAti3F
# MN166KuQPQNysDpLmRZhsuX/pWcdNxzlfuyTg6qE9aNDm5hFirhjV12bAIgEJen4
# aJJLgthLyUoD86h/ao+KYSe9oUTQ/fU/IsKjT5GNswWyKIKRXftZiAULlwbCmPgs
# pzMk7lA6QczwoLB7HU3SqFg4lunf+RuRu4sQLNLHQx2iCXShgK975jMKDFlrjrz0
# q1qXe3+uVfuE8ID+hEzX4rq9xHWhb71hEHREspgH4nSr/2jcbCY+6R/l4ASHrTDT
# DI0DfFW4FnBcJHggJetnZ4iruk40mGtwEd44ytS+ocCc4d8eAgHYO+FnQ4S2z/x0
# ty+Eo7+6CTc9Z2yxRVwZYatBg/WsHet3DUZHc86/vZWV7Z0riBD++ljop1fhs8+o
# WukHJZsSxJ6Acj2T3IyU3ztE5iaA/NLDA/CMDNJF1i7nj5ie5gTuQm5nfkIWcWLn
# BPlgxmShtpyBIU4rxm1olIbGmXRzZzF6kfLUjHlufKa7fkZvTcWFEivPmiJECKiF
# N84HYVcGFxIkwMQxc6GYNVdHfhA6RdktpFGQmKmgBzfEZRqqHGsWd/enl+w/GTCZ
# bzH76kCy59LE+snQ8FB2dFn6jW0XMr746X4D9OeHdZrUSpEshQMTAitCgPKJajbP
# yEygzp74y42tFqfT3tWbGKfGkjrxgmPxLg4kZN8CAwEAAaOCAXcwggFzMA4GA1Ud
# DwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcDAzAPBgNVHRMBAf8EBTADAQH/
# MB0GA1UdDgQWBBQfAL9GgAr8eDm3pbRD2VZQu86WOzAfBgNVHSMEGDAWgBSP8Et/
# qC5FJK5NUPpjmove4t0bvDB6BggrBgEFBQcBAQRuMGwwLQYIKwYBBQUHMAGGIWh0
# dHA6Ly9vY3NwLmdsb2JhbHNpZ24uY29tL3Jvb3RyMzA7BggrBgEFBQcwAoYvaHR0
# cDovL3NlY3VyZS5nbG9iYWxzaWduLmNvbS9jYWNlcnQvcm9vdC1yMy5jcnQwNgYD
# VR0fBC8wLTAroCmgJ4YlaHR0cDovL2NybC5nbG9iYWxzaWduLmNvbS9yb290LXIz
# LmNybDBHBgNVHSAEQDA+MDwGBFUdIAAwNDAyBggrBgEFBQcCARYmaHR0cHM6Ly93
# d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wDQYJKoZIhvcNAQEMBQADggEB
# AKz3zBWLMHmoHQsoiBkJ1xx//oa9e1ozbg1nDnti2eEYXLC9E10dI645UHY3qkT9
# XwEjWYZWTMytvGQTFDCkIKjgP+icctx+89gMI7qoLao89uyfhzEHZfU5p1GCdeHy
# L5f20eFlloNk/qEdUfu1JJv10ndpvIUsXPpYd9Gup7EL4tZ3u6m0NEqpbz308w2V
# Xeb5ekWwJRcxLtv3D2jmgx+p9+XUnZiM02FLL8Mofnrekw60faAKbZLEtGY/fadY
# 7qz37MMIAas4/AocqcWXsojICQIZ9lyaGvFNbDDUswarAGBIDXirzxetkpNiIHd1
# bL3IMrTcTevZ38GQlim9wX8wggauMIIElqADAgECAhAHNje3JFR82Ees/ShmKl5b
# MA0GCSqGSIb3DQEBCwUAMGIxCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2Vy
# dCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xITAfBgNVBAMTGERpZ2lD
# ZXJ0IFRydXN0ZWQgUm9vdCBHNDAeFw0yMjAzMjMwMDAwMDBaFw0zNzAzMjIyMzU5
# NTlaMGMxCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5EaWdpQ2VydCwgSW5jLjE7MDkG
# A1UEAxMyRGlnaUNlcnQgVHJ1c3RlZCBHNCBSU0E0MDk2IFNIQTI1NiBUaW1lU3Rh
# bXBpbmcgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDGhjUGSbPB
# PXJJUVXHJQPE8pE3qZdRodbSg9GeTKJtoLDMg/la9hGhRBVCX6SI82j6ffOciQt/
# nR+eDzMfUBMLJnOWbfhXqAJ9/UO0hNoR8XOxs+4rgISKIhjf69o9xBd/qxkrPkLc
# Z47qUT3w1lbU5ygt69OxtXXnHwZljZQp09nsad/ZkIdGAHvbREGJ3HxqV3rwN3mf
# XazL6IRktFLydkf3YYMZ3V+0VAshaG43IbtArF+y3kp9zvU5EmfvDqVjbOSmxR3N
# Ng1c1eYbqMFkdECnwHLFuk4fsbVYTXn+149zk6wsOeKlSNbwsDETqVcplicu9Yem
# j052FVUmcJgmf6AaRyBD40NjgHt1biclkJg6OBGz9vae5jtb7IHeIhTZgirHkr+g
# 3uM+onP65x9abJTyUpURK1h0QCirc0PO30qhHGs4xSnzyqqWc0Jon7ZGs506o9UD
# 4L/wojzKQtwYSH8UNM/STKvvmz3+DrhkKvp1KCRB7UK/BZxmSVJQ9FHzNklNiyDS
# LFc1eSuo80VgvCONWPfcYd6T/jnA+bIwpUzX6ZhKWD7TA4j+s4/TXkt2ElGTyYwM
# O1uKIqjBJgj5FBASA31fI7tk42PgpuE+9sJ0sj8eCXbsq11GdeJgo1gJASgADoRU
# 7s7pXcheMBK9Rp6103a50g5rmQzSM7TNsQIDAQABo4IBXTCCAVkwEgYDVR0TAQH/
# BAgwBgEB/wIBADAdBgNVHQ4EFgQUuhbZbU2FL3MpdpovdYxqII+eyG8wHwYDVR0j
# BBgwFoAU7NfjgtJxXWRM3y5nP+e6mK4cD08wDgYDVR0PAQH/BAQDAgGGMBMGA1Ud
# JQQMMAoGCCsGAQUFBwMIMHcGCCsGAQUFBwEBBGswaTAkBggrBgEFBQcwAYYYaHR0
# cDovL29jc3AuZGlnaWNlcnQuY29tMEEGCCsGAQUFBzAChjVodHRwOi8vY2FjZXJ0
# cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkUm9vdEc0LmNydDBDBgNVHR8E
# PDA6MDigNqA0hjJodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVz
# dGVkUm9vdEc0LmNybDAgBgNVHSAEGTAXMAgGBmeBDAEEAjALBglghkgBhv1sBwEw
# DQYJKoZIhvcNAQELBQADggIBAH1ZjsCTtm+YqUQiAX5m1tghQuGwGC4QTRPPMFPO
# vxj7x1Bd4ksp+3CKDaopafxpwc8dB+k+YMjYC+VcW9dth/qEICU0MWfNthKWb8RQ
# TGIdDAiCqBa9qVbPFXONASIlzpVpP0d3+3J0FNf/q0+KLHqrhc1DX+1gtqpPkWae
# LJ7giqzl/Yy8ZCaHbJK9nXzQcAp876i8dU+6WvepELJd6f8oVInw1YpxdmXazPBy
# oyP6wCeCRK6ZJxurJB4mwbfeKuv2nrF5mYGjVoarCkXJ38SNoOeY+/umnXKvxMfB
# wWpx2cYTgAnEtp/Nh4cku0+jSbl3ZpHxcpzpSwJSpzd+k1OsOx0ISQ+UzTl63f8l
# Y5knLD0/a6fxZsNBzU+2QJshIUDQtxMkzdwdeDrknq3lNHGS1yZr5Dhzq6YBT70/
# O3itTK37xJV77QpfMzmHQXh6OOmc4d0j/R0o08f56PGYX/sr2H7yRp11LB4nLCbb
# bxV7HhmLNriT1ObyF5lZynDwN7+YAN8gFk8n+2BnFqFmut1VwDophrCYoCvtlUG3
# OtUVmDG0YgkPCr2B2RP+v6TR81fZvAT6gt4y3wSJ8ADNXcL50CN/AAvkdgIm2fBl
# dkKmKYcJRyvmfxqkhQ/8mJb2VVQrH4D6wPIOK+XW+6kvRBVK5xMOHds3OBqhK/bt
# 1nz8MIIGwDCCBKigAwIBAgIQDE1pckuU+jwqSj0pB4A9WjANBgkqhkiG9w0BAQsF
# ADBjMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xOzA5BgNV
# BAMTMkRpZ2lDZXJ0IFRydXN0ZWQgRzQgUlNBNDA5NiBTSEEyNTYgVGltZVN0YW1w
# aW5nIENBMB4XDTIyMDkyMTAwMDAwMFoXDTMzMTEyMTIzNTk1OVowRjELMAkGA1UE
# BhMCVVMxETAPBgNVBAoTCERpZ2lDZXJ0MSQwIgYDVQQDExtEaWdpQ2VydCBUaW1l
# c3RhbXAgMjAyMiAtIDIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDP
# 7KUmOsap8mu7jcENmtuh6BSFdDMaJqzQHFUeHjZtvJJVDGH0nQl3PRWWCC9rZKT9
# BoMW15GSOBwxApb7crGXOlWvM+xhiummKNuQY1y9iVPgOi2Mh0KuJqTku3h4uXoW
# 4VbGwLpkU7sqFudQSLuIaQyIxvG+4C99O7HKU41Agx7ny3JJKB5MgB6FVueF7fJh
# vKo6B332q27lZt3iXPUv7Y3UTZWEaOOAy2p50dIQkUYp6z4m8rSMzUy5Zsi7qlA4
# DeWMlF0ZWr/1e0BubxaompyVR4aFeT4MXmaMGgokvpyq0py2909ueMQoP6McD1AG
# N7oI2TWmtR7aeFgdOej4TJEQln5N4d3CraV++C0bH+wrRhijGfY59/XBT3EuiQMR
# oku7mL/6T+R7Nu8GRORV/zbq5Xwx5/PCUsTmFntafqUlc9vAapkhLWPlWfVNL5Af
# J7fSqxTlOGaHUQhr+1NDOdBk+lbP4PQK5hRtZHi7mP2Uw3Mh8y/CLiDXgazT8QfU
# 4b3ZXUtuMZQpi+ZBpGWUwFjl5S4pkKa3YWT62SBsGFFguqaBDwklU/G/O+mrBw5q
# BzliGcnWhX8T2Y15z2LF7OF7ucxnEweawXjtxojIsG4yeccLWYONxu71LHx7jstk
# ifGxxLjnU15fVdJ9GSlZA076XepFcxyEftfO4tQ6dwIDAQABo4IBizCCAYcwDgYD
# VR0PAQH/BAQDAgeAMAwGA1UdEwEB/wQCMAAwFgYDVR0lAQH/BAwwCgYIKwYBBQUH
# AwgwIAYDVR0gBBkwFzAIBgZngQwBBAIwCwYJYIZIAYb9bAcBMB8GA1UdIwQYMBaA
# FLoW2W1NhS9zKXaaL3WMaiCPnshvMB0GA1UdDgQWBBRiit7QYfyPMRTtlwvNPSqU
# FN9SnDBaBgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsMy5kaWdpY2VydC5jb20v
# RGlnaUNlcnRUcnVzdGVkRzRSU0E0MDk2U0hBMjU2VGltZVN0YW1waW5nQ0EuY3Js
# MIGQBggrBgEFBQcBAQSBgzCBgDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGln
# aWNlcnQuY29tMFgGCCsGAQUFBzAChkxodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5j
# b20vRGlnaUNlcnRUcnVzdGVkRzRSU0E0MDk2U0hBMjU2VGltZVN0YW1waW5nQ0Eu
# Y3J0MA0GCSqGSIb3DQEBCwUAA4ICAQBVqioa80bzeFc3MPx140/WhSPx/PmVOZsl
# 5vdyipjDd9Rk/BX7NsJJUSx4iGNVCUY5APxp1MqbKfujP8DJAJsTHbCYidx48s18
# hc1Tna9i4mFmoxQqRYdKmEIrUPwbtZ4IMAn65C3XCYl5+QnmiM59G7hqopvBU2AJ
# 6KO4ndetHxy47JhB8PYOgPvk/9+dEKfrALpfSo8aOlK06r8JSRU1NlmaD1TSsht/
# fl4JrXZUinRtytIFZyt26/+YsiaVOBmIRBTlClmia+ciPkQh0j8cwJvtfEiy2JIM
# kU88ZpSvXQJT657inuTTH4YBZJwAwuladHUNPeF5iL8cAZfJGSOA1zZaX5YWsWMM
# xkZAO85dNdRZPkOaGK7DycvD+5sTX2q1x+DzBcNZ3ydiK95ByVO5/zQQZ/YmMph7
# /lxClIGUgp2sCovGSxVK05iQRWAzgOAj3vgDpPZFR+XOuANCR+hBNnF3rf2i6Jd0
# Ti7aHh2MWsgemtXC8MYiqE+bvdgcmlHEL5r2X6cnl7qWLoVXwGDneFZ/au/ClZpL
# EQLIgpzJGgV8unG1TnqZbPTontRamMifv427GFxD9dAq6OJi7ngE273R+1sKqHB+
# 8JeEeOMIA11HLGOoJTiXAdI/Otrl5fbmm9x+LMz/F0xNAKLY1gEOuIvu5uByVYks
# Jxlh9ncBjDCCBuYwggTOoAMCAQICEHe9DgOhtwj4VKsGchDZBEcwDQYJKoZIhvcN
# AQELBQAwUzELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2Ex
# KTAnBgNVBAMTIEdsb2JhbFNpZ24gQ29kZSBTaWduaW5nIFJvb3QgUjQ1MB4XDTIw
# MDcyODAwMDAwMFoXDTMwMDcyODAwMDAwMFowWTELMAkGA1UEBhMCQkUxGTAXBgNV
# BAoTEEdsb2JhbFNpZ24gbnYtc2ExLzAtBgNVBAMTJkdsb2JhbFNpZ24gR0NDIFI0
# NSBDb2RlU2lnbmluZyBDQSAyMDIwMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
# CgKCAgEA1kJN+eNPxiP0bB2BpjD3SD3P0OWN5SAilgdENV0Gzw8dcGDmJlT6UyNg
# AqhfAgL3jsluPal4Bb2O9U8ZJJl8zxEWmx97a9Kje2hld6vYsSw/03IGMlxbrFBn
# LCVNVgY2/MFiTH19hhaVml1UulDQsH+iRBnp1m5sPhPCnxHUXzRbUWgxYwr4W9De
# ullfMa+JaDhAPgjoU2dOY7Yhju/djYVBVZ4cvDfclaDEcacfG6VJbgogWX6Jo1gV
# lwAlad/ewmpQZU5T+2uhnxgeig5fVF694FvP8gwE0t4IoRAm97Lzei7CjpbBP86l
# 2vRZKIw3ZaExlguOpHZ3FUmEZoIl50MKd1KxmVFC/6Gy3ZzS3BjZwYapQB1Bl2KG
# vKj/osdjFwb9Zno2lAEgiXgfkPR7qVJOak9UBiqAr57HUEL6ZQrjAfSxbqwOqOOB
# Gag4yJ4DKIakdKdHlX5yWip7FWocxGnmsL5AGZnL0n1VTiKcEOChW8OzLnqLxN7x
# Sx+MKHkwRX9sE7Y9LP8tSooq7CgPLcrUnJiKSm1aNiwv37rL4kFKCHcYiK01YZQS
# 86Ry6+42nqdRJ5E896IazPyH5ZfhUYdp6SLMg8C3D0VsB+FDT9SMSs7PY7G1pBB6
# +Q0MKLBrNP4haCdv7Pj6JoRbdULNiSZ5WZ1rq2NxYpAlDQgg8f8CAwEAAaOCAa4w
# ggGqMA4GA1UdDwEB/wQEAwIBhjATBgNVHSUEDDAKBggrBgEFBQcDAzASBgNVHRMB
# Af8ECDAGAQH/AgEAMB0GA1UdDgQWBBTas43AJJCja3fTDKBZ3SFnZHYLeDAfBgNV
# HSMEGDAWgBQfAL9GgAr8eDm3pbRD2VZQu86WOzCBkwYIKwYBBQUHAQEEgYYwgYMw
# OQYIKwYBBQUHMAGGLWh0dHA6Ly9vY3NwLmdsb2JhbHNpZ24uY29tL2NvZGVzaWdu
# aW5ncm9vdHI0NTBGBggrBgEFBQcwAoY6aHR0cDovL3NlY3VyZS5nbG9iYWxzaWdu
# LmNvbS9jYWNlcnQvY29kZXNpZ25pbmdyb290cjQ1LmNydDBBBgNVHR8EOjA4MDag
# NKAyhjBodHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2NvZGVzaWduaW5ncm9vdHI0
# NS5jcmwwVgYDVR0gBE8wTTBBBgkrBgEEAaAyATIwNDAyBggrBgEFBQcCARYmaHR0
# cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wCAYGZ4EMAQQBMA0G
# CSqGSIb3DQEBCwUAA4ICAQAIiHImxq/6rF8GwKqMkNrQssCil/9uEzIWVP0+9DAR
# n4+Y+ZtS3fKiFu7ZeJWmmnxhuAS1+OvL9GERM/ZlJbcRQovYaW7H/5W0gUOpfq6/
# gtZNzBGjg3FqEF4ZBafnbH9W9Khcw04JrVlruPl+pS64/N4OwqD7sATUExvHJ6m5
# qi0xO89GTJ3rTOy8Lpzxh6N/OGlfQUBn9lN96kHvjj37qdQROEbfPOv2zSK9E83w
# 4eblM6C+POR41RvMIPIwc7AiHPaE1ptcAALhKFJL/xJLQOrusBoGBp6E5ufw24RG
# +3PZK0K2yVc0xxbApushuaoO9/7byuu8F8u4Z+vjPk/bqZSGZFXJCQrA2QRxShFL
# WmTDvHh4rUxHJmUHmdXNNmChM1Oz9nsq1YlAPHGlq/iZWf3jm5JL3QW9Cwx4BivP
# U9i9EppbJ4aFP5G+4HiAc1Tfpx1nK2q2rk2JgCQIUnBQ8wH/RK4vmuDhSQjh4VvX
# ONGeCoqdlCebyqO52+I2auNvuVhi4DZ4NgH6waeJeiZTo1y70rLristjCC/+HvNW
# KeI1m9j/6aW9bUtZLIksL1K7tSmQ2kNHvHLdvNm/gMHcsKu0Sx1YNjdk65vhhRea
# KaL95gjSkv+g+Hzh6afRMI5fJlArx6Lil3eK79hNPibrmUBg8zxnDLYIcik1U4E0
# 3DCCBxwwggUEoAMCAQICDElF7GllQBbooYM+/DANBgkqhkiG9w0BAQsFADBZMQsw
# CQYDVQQGEwJCRTEZMBcGA1UEChMQR2xvYmFsU2lnbiBudi1zYTEvMC0GA1UEAxMm
# R2xvYmFsU2lnbiBHQ0MgUjQ1IENvZGVTaWduaW5nIENBIDIwMjAwHhcNMjIwMzAy
# MTE0ODM5WhcNMjQwNjE0MTQzMDQ0WjCBiTELMAkGA1UEBhMCVVMxETAPBgNVBAgT
# CE5ldyBZb3JrMREwDwYDVQQHEwhOZXcgWW9yazEWMBQGA1UEChMNU0VNUEVSSVMg
# SU5DLjEWMBQGA1UEAxMNU0VNUEVSSVMgSU5DLjEkMCIGCSqGSIb3DQEJARYVY29k
# ZXNpZ25Ac2VtcGVyaXMuY29tMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKC
# AgEAr6tl3SlmfsaiEOfMdtp4zvTErHoof7dk7J3pCnooplIEiChxu0y8qc9lcdPj
# 7pr8RJvSbG110CsfV6GzWevZUVJWmQqvE4mugzLxhFABL4t0r8HZSSa/gKMEndXr
# 3SUhwdbLmg38F+yuzyGoiHY55ecMHPWoz89tBYlezlISI2C0+E/RQC8/c8STflpX
# FCVEpqFwJnY1x5rz+jEDTu8ITyNmrhb66uzogNTdgsl0xasM9TpE5VKrWSLAg37i
# Frj0GRjwd/pzTfO3tXhH4zt728F04HuuPf+3F3ETLhSsrk1lBNwMV+UBVjPJrVro
# 1brvEHn7D88BicGkT/qFh0+R5jUu7O8BJ+/g4IHp4yKOtp/Ockp05Yi6H45fX35c
# QddB6twWIFbGcjRGAadYUSkacUOfGRzAJKQOJYmN3ISOJJT1hoHCFtR9sqjN0pQa
# 2k1bk/bJGmTrmt7uUPJ5Ucnl1qHgZkPD5R9ERXXjZ00cX5mOx5l0gpxvg+01R4cy
# TyxgRzAuBU46q6P8ESh4hiyJM+nnao8+eE8Sr/VN/VC7CCtLEGWl2/Ek1KeniiuZ
# SrdMFnnaI0G4tqqG97mSIBoPuKwBCk+FpvGXQ8u3jd2mU8P4uZo4hH8Mib4L81k/
# 8oSc+vmQzEBiBSY/S9g2j51EnoyzAuyvJMmcCVF1Rp9TUU0CAwEAAaOCAbEwggGt
# MA4GA1UdDwEB/wQEAwIHgDCBmwYIKwYBBQUHAQEEgY4wgYswSgYIKwYBBQUHMAKG
# Pmh0dHA6Ly9zZWN1cmUuZ2xvYmFsc2lnbi5jb20vY2FjZXJ0L2dzZ2NjcjQ1Y29k
# ZXNpZ25jYTIwMjAuY3J0MD0GCCsGAQUFBzABhjFodHRwOi8vb2NzcC5nbG9iYWxz
# aWduLmNvbS9nc2djY3I0NWNvZGVzaWduY2EyMDIwMFYGA1UdIARPME0wQQYJKwYB
# BAGgMgEyMDQwMgYIKwYBBQUHAgEWJmh0dHBzOi8vd3d3Lmdsb2JhbHNpZ24uY29t
# L3JlcG9zaXRvcnkvMAgGBmeBDAEEATAJBgNVHRMEAjAAMEUGA1UdHwQ+MDwwOqA4
# oDaGNGh0dHA6Ly9jcmwuZ2xvYmFsc2lnbi5jb20vZ3NnY2NyNDVjb2Rlc2lnbmNh
# MjAyMC5jcmwwEwYDVR0lBAwwCgYIKwYBBQUHAwMwHwYDVR0jBBgwFoAU2rONwCSQ
# o2t30wygWd0hZ2R2C3gwHQYDVR0OBBYEFHl2JYTkRF1JSD0dmaZEJrMSJ1pZMA0G
# CSqGSIb3DQEBCwUAA4ICAQC1QWVq8P2sWcGYHIPqTtMGIv6YV8RNYVDsS2nkSUsU
# xGGZO0GrGKDNn0epo1M1dXWtbECkivTrVA2x3Ku/yVysHHSliLbcL/QCPkbXT8hr
# 3s71X53tbAQp96iMSt/+RURXWH7bnBOCLfO1BeH9ua0uRYBpy3OYfuDEICowr4SN
# Rf2iY0wSoWZ85QsBlMgLLFymJln9Pjw8SYsVOYkwfMiv1aT7uCxVlkYtKW9bkmyb
# HuKiEduQwSfs5GzegSFM+WcfC4JqBhVXRBxQljX53Y1rb3eA8CVLTHZPVqXXM8di
# 628y1IylTdTzXcriFjCmMYZ0re+FNlVBT6KhJ+nP+pcSmrbVy9qg/BX1fQD5XGT6
# 3VdQp4qfTK25uWHWHm0GlOMR/SyC5HEmpASUkL5tHr+n+9GoRyS8IjQop37RJ1hK
# oBXlH0ayyQWHvLQjCM5Hx+ARSDq3HdeqK3ToAuUDJ+G5qgr0BP3X9Ap4K7fSn8p0
# gafpMdSBWRnmfIhPa0E4XEMA++XQtfy+gA4nr/0zD05uB+vpSli97phr6f3duafm
# NJbH40z7xlg2euTBd7CkUtI3KwFq0pvdgln0Xsjl5NhR4yY7Y9oQIjWd9ooFYWqx
# nphR9JecB3P+CkVA3L7Xwqu5PIXSZ+bPhF5a8yNNThYmm8g20dl3vCaZiX5/RHvt
# 8jGCBjYwggYyAgEBMGkwWTELMAkGA1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNp
# Z24gbnYtc2ExLzAtBgNVBAMTJkdsb2JhbFNpZ24gR0NDIFI0NSBDb2RlU2lnbmlu
# ZyBDQSAyMDIwAgxJRexpZUAW6KGDPvwwDQYJYIZIAWUDBAIBBQCgfDAQBgorBgEE
# AYI3AgEMMQIwADAZBgkqhkiG9w0BCQMxDAYKKwYBBAGCNwIBBDAcBgorBgEEAYI3
# AgELMQ4wDAYKKwYBBAGCNwIBFTAvBgkqhkiG9w0BCQQxIgQgcJkhZH5dn8TaXzpv
# EpaXBJTFXSTraje6DJd8R4LhylwwDQYJKoZIhvcNAQEBBQAEggIAZi3U9dq/o88E
# ncskC07ww3glZVxxefsDKYR9QwbIYFH/TthvvArCZ5Y6pbfR8fAd7527IJLXWs31
# yI01pxoDzclFyRaWhDwQElsSIYTbAsR4kjm7LgY4VUIzOxL6ZubW/zTB8ZsZpVH1
# NPjMVa59BZ8ZzwEQms69meziwiIcHiiAyaoG+XnNuqsnK8PejqraO07OQpxL0fEk
# mDKfMYQPDkno9CEOx36HuWzodFd/S2lavoyqqwXf0sRn1ebdBZuWULIxMpyPFY36
# YcPCHERkcSJ5EaeKHrzL7qLUAPLAaihBFhkESjR2nHtMlbjri3ETTOgbOs5mEbC8
# Krh05q+WsrJogK5qcbQ1g+gBlzluBd2yDkhS3eDltX1KZNALHRTYM2MCX6KMvseM
# 5F2JoJjueRt/3e7K0HdcOWqAd/2/MA4ZaJFWmB/935J3J/OhHHI8dhoQDeAmGLmh
# 0eMAhBymk/mAKmfVroBI9vT3kgbR2V60VgCErNNcM5IgtpJl+Xa33REY4xAVpVT2
# CgKgRygHYvQNQljpcJtcq0ac9ma16RjOR2QaQCwFH/UDNBc8I6zpjQ3+LBHp1NSu
# vp3jEblV/10h9xAINgsfP0gcw/Ea42B9lBx+Ud9zaFc9/a+SP8YsZr6MHIne3kj3
# 2lD5ItUUshYkUnvtVChNRztp+/5tT7ShggMgMIIDHAYJKoZIhvcNAQkGMYIDDTCC
# AwkCAQEwdzBjMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4x
# OzA5BgNVBAMTMkRpZ2lDZXJ0IFRydXN0ZWQgRzQgUlNBNDA5NiBTSEEyNTYgVGlt
# ZVN0YW1waW5nIENBAhAMTWlyS5T6PCpKPSkHgD1aMA0GCWCGSAFlAwQCAQUAoGkw
# GAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjIxMjEx
# MDkyMDA1WjAvBgkqhkiG9w0BCQQxIgQggzsgnOnb4a35x387DnjoxZ4xNb8xScua
# gJfkB0ums/kwDQYJKoZIhvcNAQEBBQAEggIAnP9PjP2CIfIcj/M6zjCp+drB5Od/
# gFQJR1vpGstv0njBNTBSmLjmCRZFlRuIjvYsAIHm2Nde/wEl3QpZnfNcJO86w5Do
# Mdlt3qlpoGp7htQsBu7kgCm/AO0jy5WgLHWCWcq1MIJ8yrUrQArvwX/RrbTmeQP1
# gbMkRQGHxC4YCUJUFC40IhwCgbFctOZPR+fyEzyHFqldb0OlrDYVnAIpoERxbzn3
# DQnnp6wjUCwbYq/edvyEcELkSCO4nvX0aPsT5JB7rGrcY/POgsf1ZBlH5PeOSdm7
# TtrBYeRzWi9xpzPq8Z7QNV+3UlehabS4stOAl0+sRw4PvCDc0FqiO/KjM5jcaGlx
# PIbVje1rUZNP0yMi/Z59dtBH4/AWFLM8IVbVztUoM648AhuxmhF829tUZmS4zOrR
# jswIg5O0ZBgV983F52xvt+jNCPQsrCIz1WOXYG5qztJDuUZglEBCu6hxyru5Rwib
# 8AgNZiTsyrVgWQA+lsOGYL32nGqkzkGtsjfh3mEAQCUNM4pP4ox61ly7RblYjwZ0
# xN9DR3LFcmI0lgHrx1przi/wn5WfUdkUaJxgL4dSz453U1Zp6zmYh/ufjzCUAVHo
# 11UE/TEi0smSpMIkAR/B3kMs5v0W+9S3Ov+ZogsBEFrgstjHbr8Bg8t9Ng+9Z62V
# ReZ+cuFyG27+bJI=
# SIG # End signature block
