# Script to collect windows events # # Parameters to limit/control the events collected: # exclude/include: event id's you want to include or exclude (default is include all) # -currently, if you use the include flag the scan will ONLY include those events # event_days/event_hours: how many days/hours of events to collect (default 24hrs) # event_limit: maximum events to collect (default 40) # entry types: Error, FailureAudit, Warning, SuccessAudit (default error, failureaudit, warning) # file: Path to file for results output # Example script invocations: # events_scan.ps1 -exclude 1005 -event_days 7 -event_limit 100 -entry_types error, warning # events_scan.ps1 -event_days 7 -event_limit 1000 -entry_types error [CmdletBinding()] param([array]$exclude, [array]$include, [int]$event_days, [int]$event_hours, [int]$event_limit, [array]$entry_types, [string]$file) #Writes to the log function Write-Log { [CmdletBinding()] param([string] $message) try { Write-Verbose $message } catch { } } function Write-Log-Hashtable { [CmdletBinding()] param([System.Collections.Hashtable]$dict) try { Write-Log($dict | Out-String) } catch { } } $default_events = @(0..65535)# EventID Filter List $windows_events = @{} $events = @() $logs = @("Security", "Application", "System") $select = @("EventID", "EntryType", "TimeGenerated", "Source", "UserName", "Message", "Index") # Escapes special JSON characters. function PS2_Escape-JSONString { [CmdletBinding()] param([string] $str) if ($str -eq $null) { return "" } $str = $str.ToString() $str = $str.Replace('"','\"') $str = $str.Replace('\','\\') $str = $str.Replace("`n",'\n') $str = $str.Replace("`r",'\r') $str = $str.Replace("`t",'\t') $str = $str.Replace('\\"','\"') return $str; } # Converts a given powershell (WMI) object to a JSON string. function PS2_ConvertTo-JSON { param([int] $maxDepth = 100, [bool] $forceArray = $false) begin { # Initializer $data = @() } process { # Iterator $data += $_ } end { # Finalizer # Convert to string or Array if ($data.length -eq 1 -and $forceArray -eq $false) { $value = $data[0] } else { $value = $data } # Validation if ($value -eq $null) { return "null" } $dataType = $value.GetType().Name # DataType specific processing/formatting switch -regex ($dataType) { 'String' { return "`"{0}`"" -f (PS2_Escape-JSONString $value) } '(System\.)?DateTime' { return "`"{0:yyyy-MM-dd}T{0:HH:mm:ss}`"" -f $value } 'Int32|Double|UInt32|UInt64|Int64|Float|Int16|UInt16' { return "$value" } 'Boolean' { return "$value".ToLower() } '(System\.)?Object\[\]' { # array # Short-Circuit on Empty if ($maxDepth -le 0) { return "`"$value`"" } # Create Delimited JSON results string $jsonResult = '' foreach($elem in $value) { if ($jsonResult.Length -gt 0) { $jsonResult += ', ' } $jsonResult += ($elem | PS2_ConvertTo-JSON -maxDepth ($maxDepth -1)) } return "[$jsonResult]" } '(System\.)?Hashtable' { # hashtable # Create Delimited JSON results string $jsonResult = '' foreach($key in $value.Keys) { if ($jsonResult.Length -gt 0) { $jsonResult +=', ' } $jsonResult += "`"{0}`": {1}" -f $key, ($value[$key] | PS2_ConvertTo-JSON -maxDepth ($maxDepth -1)) } return "{$jsonResult}" } default { #object # Generic Object Conversion to Delimited JSON results string if ($maxDepth -le 0) { return "`"{0}`"" -f (PS2_Escape-JSONString $value) } return "{" + (($value | Get-Member -MemberType *property | % { "`"{0}`": {1}" -f $_.Name, ($value.($_.Name) | PS2_ConvertTo-JSON -maxDepth ($maxDepth -1)) }) -join ', ') + "}" } } } } # Convert days to hours, combine with hours param, and negate $combined_hours = (($event_days * 24) + $event_hours) * (-1) # Set defaults in case no parameters are included if ($combined_hours -eq 0) { $combined_hours = -24 } if ($event_limit -eq 0) { $event_limit = 40 } if (!$entry_types) { $entry_types = @("Error", "FailureAudit", "Warning") } # Determine which events we'll be including if ($include -Or ($include -And $exclude)) { # we need to include all types here so users wanting to include certain events don't miss due to the default type filter # since the include flag causes only events on the include list to be collected we'll do the same thing if they have both an include and exclude list # the UI should prevent events with the same ids from being added to each list to avoid user confusion here $list = $include } elseif ($exclude) { # subtract the exclude list from the default event list # since we're just excluding we don't need to remove the type filters $list = $default_events | ?{ -not ($exclude -contains $_) } } else { # list all events $list = $default_events } foreach ($log in $logs) { try { # retrieve event log events Write-Log "Scanning $($log) event log..." $event_list = Get-eventlog $log -Newest $event_limit -EntryType $entry_types -After (Get-Date).AddHours($combined_hours) -ErrorAction Continue | Select-Object $select | Where-Object {$list -contains $_.EventID} $event_list | ForEach-Object { # add log and entry-type properties $temp = $_ $temp | Add-Member -membertype noteproperty -name "Log" -value $log $temp | Add-Member -membertype noteproperty -name "EntryType" -value $temp.EntryType.value__ -Force $events += $temp } } catch { } } # retrieve event logs $event_logs = Get-WmiObject Win32_NTEventlogFile | Select-Object LogFileName, NumberOfRecords, FileSize, MaxFileSize | Where {$_.LogFileName -ne "Internet Explorer"} # build result hash $scan_data = @{ "EventLogs" = $event_logs; "WindowsEvents" = $events; } # serialize $jsonData = ($scan_data | PS2_ConvertTo-JSON) # write output to requested file Remove-Item $file -ErrorAction Continue -Confirm:$false New-Item $file -type file Set-Content -Path $file -value $jsonData return $jsonData # SIG # Begin signature block # MIIb+AYJKoZIhvcNAQcCoIIb6TCCG+UCAQExDzANBglghkgBZQMEAgEFADB5Bgor # BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG # KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCBvYiQ216UXE9jI # BaHFXUEf7DpEkH60G8DKfz1EG8vZQ6CCCs4wggVWMIIEPqADAgECAhAZGjLLdZyX # uM+sEY3VEn9JMA0GCSqGSIb3DQEBCwUAMIHKMQswCQYDVQQGEwJVUzEXMBUGA1UE # ChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsTFlZlcmlTaWduIFRydXN0IE5ldHdv # cmsxOjA4BgNVBAsTMShjKSAyMDA2IFZlcmlTaWduLCBJbmMuIC0gRm9yIGF1dGhv # cml6ZWQgdXNlIG9ubHkxRTBDBgNVBAMTPFZlcmlTaWduIENsYXNzIDMgUHVibGlj # IFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkgLSBHNTAeFw0xNDAzMDQw # MDAwMDBaFw0yNDAzMDMyMzU5NTlaMIGRMQswCQYDVQQGEwJVUzEdMBsGA1UEChMU # U3ltYW50ZWMgQ29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5l # dHdvcmsxQjBABgNVBAMTOVN5bWFudGVjIENsYXNzIDMgRXh0ZW5kZWQgVmFsaWRh # dGlvbiBDb2RlIFNpZ25pbmcgQ0EgLSBHMjCCASIwDQYJKoZIhvcNAQEBBQADggEP # ADCCAQoCggEBANAYAu7too0IWGMPJtfdInuI9uTH7DsmGHjTx6QgU42DfKU/fqXI # K0ffDfWm2cMdJZNgz3zc6gMsvnh/XEhtpwLZSfih6+uaYXyfwCbW3BXYuBB8ILpe # 9Cj2qOqnXHzGnJCQNDy2Iqz+ugw6HtZehLZb8KOBcHiKjUZSe/zbSfMpExF0T40W # s8LjoC3HAwSdzMNy4Q4M+wKO8SYXe26u+Lczi6ZhS0Xf8iVEx/ewmCM23Ch5Cuib # coio2Oiue38KZEWl8FeSmncGRR7rn+hm83p9koFfAC0euPZWE1piDbdHoY9y74Ne # guCUmOGspa2GN+Cn07qxPnrrRajxwUR94gMCAwEAAaOCAW0wggFpMBIGA1UdEwEB # /wQIMAYBAf8CAQAwLwYDVR0fBCgwJjAkoCKgIIYeaHR0cDovL3Muc3ltY2IuY29t # L3BjYTMtZzUuY3JsMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMDMA4GA1UdDwEB/wQE # AwIBBjAuBggrBgEFBQcBAQQiMCAwHgYIKwYBBQUHMAGGEmh0dHA6Ly9zLnN5bWNk # LmNvbTBfBgNVHSAEWDBWMFQGBFUdIAAwTDAjBggrBgEFBQcCARYXaHR0cHM6Ly9k # LnN5bWNiLmNvbS9jcHMwJQYIKwYBBQUHAgIwGRoXaHR0cHM6Ly9kLnN5bWNiLmNv # bS9ycGEwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVN5bWFudGVjUEtJLTEtNjI5 # MB0GA1UdDgQWBBQWZt5KNONQpxGGA7FsqcaszVlumzAfBgNVHSMEGDAWgBR/02Wn # wt3su/AwCfNDOfoCrzMxMzANBgkqhkiG9w0BAQsFAAOCAQEAP1sZ8/oT1XU4Klru # n1qgTKkdxcyU7t4V/vUQbqQbpWSDVBhYxAsooYXDTnTl/4l8/tXtPLpxn1YCJo8W # Koj+sKMnIs5L4jiOAKY6hl+d5T6o3mRJQXRBIf0HyIQX2h1lMILLJk851gQnpIGx # S0nDI4t+AjIYJ7erC/MYcrak7mcGbzimWI3g8X5dpGDGqOVQX+DouuKPmVi2taCo # dvGi8RyIQXJ+UpebCjaZjVD3Aes85/AiauU1jGM2ihqx2WdmX5ca76ggnfAvumzO # 2ZSFAPFY8X3JfCK1B10CxuYLv6uTk/8nGI4zNn5XNPHDrwTBhPFWs+iHgzb40wox # 3G4sbTCCBXAwggRYoAMCAQICECN/QLeJHIBtWd+ICWoxF34wDQYJKoZIhvcNAQEL # BQAwgZExCzAJBgNVBAYTAlVTMR0wGwYDVQQKExRTeW1hbnRlYyBDb3Jwb3JhdGlv # bjEfMB0GA1UECxMWU3ltYW50ZWMgVHJ1c3QgTmV0d29yazFCMEAGA1UEAxM5U3lt # YW50ZWMgQ2xhc3MgMyBFeHRlbmRlZCBWYWxpZGF0aW9uIENvZGUgU2lnbmluZyBD # QSAtIEcyMB4XDTE5MDIyMjAwMDAwMFoXDTIxMDIyMDIzNTk1OVowgfExEzARBgsr # BgEEAYI3PAIBAxMCVVMxGTAXBgsrBgEEAYI3PAIBAgwIRGVsYXdhcmUxFzAVBgsr # BgEEAYI3PAIBAQwGQXVzdGluMR0wGwYDVQQPExRQcml2YXRlIE9yZ2FuaXphdGlv # bjEQMA4GA1UEBRMHNDA4OTk4NzELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBVRleGFz # MQ8wDQYDVQQHDAZBdXN0aW4xGDAWBgNVBAoMD1NwaWNld29ya3MsIEluYzETMBEG # A1UECwwKT3BlcmF0aW9uczEYMBYGA1UEAwwPU3BpY2V3b3JrcywgSW5jMIIBIjAN # BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvMzNtFfHFFMCyNu3P7btG2TWPAqc # NQJM2aZ1V4khF+PZlBPMDP6Cl1JsDq3kKgZwmRuAeNwvlRod9kdCp9OJe77U4FX7 # FX8bgDBmFkPCdftjDS9tjWVDRFlkleFpV1FC/VTip6eCi/B53YrTNC9KFIegOSkY # 693yTn612GJlwesvlk/TwLCGyrbFb6HAYgDBOmw5e+MiJ07wrGDKZ/uDX7sbbjOq # vWm4KUjlhphvRcCmHZQEuqZy3zoOpZHry4H5DXcPpKUTPAsgM5Ih0CE3XQGtNycm # D6/UkgPAVVMuFDU/kvoHoZCOFNL4+P7smqqLYlhC+zzH+JfAdepBj866aQIDAQAB # o4IBYDCCAVwwCQYDVR0TBAIwADAOBgNVHQ8BAf8EBAMCB4AwKwYDVR0fBCQwIjAg # oB6gHIYaaHR0cDovL3N3LnN5bWNiLmNvbS9zdy5jcmwwYAYDVR0gBFkwVzBVBgVn # gQwBAzBMMCMGCCsGAQUFBwIBFhdodHRwczovL2Quc3ltY2IuY29tL2NwczAlBggr # BgEFBQcCAjAZDBdodHRwczovL2Quc3ltY2IuY29tL3JwYTAWBgNVHSUBAf8EDDAK # BggrBgEFBQcDAzAfBgNVHSMEGDAWgBQWZt5KNONQpxGGA7FsqcaszVlumzAdBgNV # HQ4EFgQUKxpC85BC/DBUr5duVa0Rn6jG+B4wWAYIKwYBBQUHAQEETDBKMB8GCCsG # AQUFBzABhhNodHRwOi8vc3cuc3ltY2QuY29tMCcGCCsGAQUFBzAChhtodHRwOi8v # c3cxLnN5bWNiLmNvbS9zdy5jcnQwDQYJKoZIhvcNAQELBQADggEBAHxOX8KutfpP # yjJGX5nwrWcr/fkzX6caI9+36Jay5EK+wALb2T8G5wGj9E0UyqeRWeHYna31n+X1 # gwPhZ0JV00l2MP75ORiuAOJ09n3LDIV1R9hHMtrrRVnpj6dizsOW1lp6tuY7r9BZ # B4LHG5epYL4E/cBcaxzVW8+2k8X6pPqFKKuQuf0Bhu5RRbK5/DxILGuyV0FEF/3P # xud1mfsB40jK1KUfMp6C6YxPW2p6tYZlsJIv2IEblih9JpVOiuGK4XQQQSOTknRF # KY/GBSClVB+od5Hq/9qhALtehC8y5MlKALaAkICdwTf5HEwlUnna4Ep1Y3u5UVVy # bJHjeuLmcl4xghCAMIIQfAIBATCBpjCBkTELMAkGA1UEBhMCVVMxHTAbBgNVBAoT # FFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBO # ZXR3b3JrMUIwQAYDVQQDEzlTeW1hbnRlYyBDbGFzcyAzIEV4dGVuZGVkIFZhbGlk # YXRpb24gQ29kZSBTaWduaW5nIENBIC0gRzICECN/QLeJHIBtWd+ICWoxF34wDQYJ # YIZIAWUDBAIBBQCgfDAQBgorBgEEAYI3AgEMMQIwADAZBgkqhkiG9w0BCQMxDAYK # KwYBBAGCNwIBBDAcBgorBgEEAYI3AgELMQ4wDAYKKwYBBAGCNwIBFTAvBgkqhkiG # 9w0BCQQxIgQga51fY3nxZpOQAQHbOP9jOnv8S3DU6jt5Q5M/cbDjHz4wDQYJKoZI # hvcNAQEBBQAEggEAcNhKsMoGtyTdrcak6BAkwazadPQbdK5E/M0/C+ar6Db72mtc # IpNBDxCLkN4Qh8Wosxt3uVgCAzds6ydrbr/rnzUYb5CVqTnDDwOSJtyiRbNvVwqA # QzA95/vJoHiKvOf1bjIa9wMbJvs1GZkmwLlSHHQ5+gZuU3kb0lYHhHMMMTWfwbYw # O7NHapDhVTsDlWPkoo8kAcAUIokXzkRfLNt7KJWGz/GP1Fa/RFS+5beRyd8V1J+R # k1Hez6UWcWVrvmpMQBeN01wc3l678LcaqM2e1JICP2FlYZyEgu035VSiTL4NN/aU # cujNg2XhgImg47gxCm7U64aS09J8Hipb/3diwqGCDiwwgg4oBgorBgEEAYI3AwMB # MYIOGDCCDhQGCSqGSIb3DQEHAqCCDgUwgg4BAgEDMQ0wCwYJYIZIAWUDBAIBMIH/ # BgsqhkiG9w0BCRABBKCB7wSB7DCB6QIBAQYLYIZIAYb4RQEHFwMwITAJBgUrDgMC # GgUABBS1uUq+HOaWDo8q67EAURgoEBA/AQIVAIu2Ph8MmzM5hkqABQFQAN0Hg/p9 # GA8yMDIwMDMwOTIyMzUzM1owAwIBHqCBhqSBgzCBgDELMAkGA1UEBhMCVVMxHTAb # BgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBU # cnVzdCBOZXR3b3JrMTEwLwYDVQQDEyhTeW1hbnRlYyBTSEEyNTYgVGltZVN0YW1w # aW5nIFNpZ25lciAtIEczoIIKizCCBTgwggQgoAMCAQICEHsFsdRJaFFE98mJ0pwZ # nRIwDQYJKoZIhvcNAQELBQAwgb0xCzAJBgNVBAYTAlVTMRcwFQYDVQQKEw5WZXJp # U2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazE6MDgG # A1UECxMxKGMpIDIwMDggVmVyaVNpZ24sIEluYy4gLSBGb3IgYXV0aG9yaXplZCB1 # c2Ugb25seTE4MDYGA1UEAxMvVmVyaVNpZ24gVW5pdmVyc2FsIFJvb3QgQ2VydGlm # aWNhdGlvbiBBdXRob3JpdHkwHhcNMTYwMTEyMDAwMDAwWhcNMzEwMTExMjM1OTU5 # WjB3MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMgQ29ycG9yYXRpb24x # HzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxKDAmBgNVBAMTH1N5bWFu # dGVjIFNIQTI1NiBUaW1lU3RhbXBpbmcgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IB # DwAwggEKAoIBAQC7WZ1ZVU+djHJdGoGi61XzsAGtPHGsMo8Fa4aaJwAyl2pNyWQU # Sym7wtkpuS7sY7Phzz8LVpD4Yht+66YH4t5/Xm1AONSRBudBfHkcy8utG7/YlZHz # 8O5s+K2WOS5/wSe4eDnFhKXt7a+Hjs6Nx23q0pi1Oh8eOZ3D9Jqo9IThxNF8ccYG # KbQ/5IMNJsN7CD5N+Qq3M0n/yjvU9bKbS+GImRr1wOkzFNbfx4Dbke7+vJJXcnf0 # zajM/gn1kze+lYhqxdz0sUvUzugJkV+1hHk1inisGTKPI8EyQRtZDqk+scz51ivv # t9jk1R1tETqS9pPJnONI7rtTDtQ2l4Z4xaE3AgMBAAGjggF3MIIBczAOBgNVHQ8B # Af8EBAMCAQYwEgYDVR0TAQH/BAgwBgEB/wIBADBmBgNVHSAEXzBdMFsGC2CGSAGG # +EUBBxcDMEwwIwYIKwYBBQUHAgEWF2h0dHBzOi8vZC5zeW1jYi5jb20vY3BzMCUG # CCsGAQUFBwICMBkaF2h0dHBzOi8vZC5zeW1jYi5jb20vcnBhMC4GCCsGAQUFBwEB # BCIwIDAeBggrBgEFBQcwAYYSaHR0cDovL3Muc3ltY2QuY29tMDYGA1UdHwQvMC0w # K6ApoCeGJWh0dHA6Ly9zLnN5bWNiLmNvbS91bml2ZXJzYWwtcm9vdC5jcmwwEwYD # VR0lBAwwCgYIKwYBBQUHAwgwKAYDVR0RBCEwH6QdMBsxGTAXBgNVBAMTEFRpbWVT # dGFtcC0yMDQ4LTMwHQYDVR0OBBYEFK9j1sqjToVy4Ke8QfMpojh/gHViMB8GA1Ud # IwQYMBaAFLZ3+mlIR59TEtXC6gcydgfRlwcZMA0GCSqGSIb3DQEBCwUAA4IBAQB1 # 6rAt1TQZXDJF/g7h1E+meMFv1+rd3E/zociBiPenjxXmQCmt5l30otlWZIRxMCrd # HmEXZiBWBpgZjV1x8viXvAn9HJFHyeLojQP7zJAv1gpsTjPs1rSTyEyQY0g5QCHE # 3dZuiZg8tZiX6KkGtwnJj1NXQZAv4R5NTtzKEHhsQm7wtsX4YVxS9U72a433Snq+ # 8839A9fZ9gOoD+NT9wp17MZ1LqpmhQSZt/gGV+HGDvbor9rsmxgfqrnjOgC/zoqU # ywHbnsc4uw9Sq9HjlANgCk2g/idtFDL8P5dA4b+ZidvkORS92uTTw+orWrOVWFUE # fcea7CMDjYUq0v+uqWGBMIIFSzCCBDOgAwIBAgIQe9Tlr7rMBz+hASMEIkFNEjAN # BgkqhkiG9w0BAQsFADB3MQswCQYDVQQGEwJVUzEdMBsGA1UEChMUU3ltYW50ZWMg # Q29ycG9yYXRpb24xHzAdBgNVBAsTFlN5bWFudGVjIFRydXN0IE5ldHdvcmsxKDAm # BgNVBAMTH1N5bWFudGVjIFNIQTI1NiBUaW1lU3RhbXBpbmcgQ0EwHhcNMTcxMjIz # MDAwMDAwWhcNMjkwMzIyMjM1OTU5WjCBgDELMAkGA1UEBhMCVVMxHTAbBgNVBAoT # FFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYDVQQLExZTeW1hbnRlYyBUcnVzdCBO # ZXR3b3JrMTEwLwYDVQQDEyhTeW1hbnRlYyBTSEEyNTYgVGltZVN0YW1waW5nIFNp # Z25lciAtIEczMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArw6Kqvjc # v2l7VBdxRwm9jTyB+HQVd2eQnP3eTgKeS3b25TY+ZdUkIG0w+d0dg+k/J0ozTm0W # iuSNQI0iqr6nCxvSB7Y8tRokKPgbclE9yAmIJgg6+fpDI3VHcAyzX1uPCB1ySFdl # Ta8CPED39N0yOJM/5Sym81kjy4DeE035EMmqChhsVWFX0fECLMS1q/JsI9KfDQ8Z # bK2FYmn9ToXBilIxq1vYyXRS41dsIr9Vf2/KBqs/SrcidmXs7DbylpWBJiz9u5iq # ATjTryVAmwlT8ClXhVhe6oVIQSGH5d600yaye0BTWHmOUjEGTZQDRcTOPAPstwDy # OiLFtG/l77CKmwIDAQABo4IBxzCCAcMwDAYDVR0TAQH/BAIwADBmBgNVHSAEXzBd # MFsGC2CGSAGG+EUBBxcDMEwwIwYIKwYBBQUHAgEWF2h0dHBzOi8vZC5zeW1jYi5j # b20vY3BzMCUGCCsGAQUFBwICMBkaF2h0dHBzOi8vZC5zeW1jYi5jb20vcnBhMEAG # A1UdHwQ5MDcwNaAzoDGGL2h0dHA6Ly90cy1jcmwud3Muc3ltYW50ZWMuY29tL3No # YTI1Ni10c3MtY2EuY3JsMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMA4GA1UdDwEB # /wQEAwIHgDB3BggrBgEFBQcBAQRrMGkwKgYIKwYBBQUHMAGGHmh0dHA6Ly90cy1v # Y3NwLndzLnN5bWFudGVjLmNvbTA7BggrBgEFBQcwAoYvaHR0cDovL3RzLWFpYS53 # cy5zeW1hbnRlYy5jb20vc2hhMjU2LXRzcy1jYS5jZXIwKAYDVR0RBCEwH6QdMBsx # GTAXBgNVBAMTEFRpbWVTdGFtcC0yMDQ4LTYwHQYDVR0OBBYEFKUTAamfhcwbbhYe # Xzsxqnk2AHsdMB8GA1UdIwQYMBaAFK9j1sqjToVy4Ke8QfMpojh/gHViMA0GCSqG # SIb3DQEBCwUAA4IBAQBGnq/wuKJfoplIz6gnSyHNsrmmcnBjL+NVKXs5Rk7nfmUG # WIu8V4qSDQjYELo2JPoKe/s702K/SpQV5oLbilRt/yj+Z89xP+YzCdmiWRD0Hkr+ # Zcze1GvjUil1AEorpczLm+ipTfe0F1mSQcO3P4bm9sB/RDxGXBda46Q71Wkm1SF9 # 4YBnfmKst04uFZrlnCOvWxHqcalB+Q15OKmhDc+0sdo+mnrHIsV0zd9HCYbE/JEl # shuW6YUI6N3qdGBuYKVWeg3IRFjc5vlIFJ7lv94AvXexmBRyFCTfxxEsHwA/w0sU # xmcczB4Go5BfXFSLPuMzW4IPxbeGAk5xn+lmRT92MYICWjCCAlYCAQEwgYswdzEL # MAkGA1UEBhMCVVMxHTAbBgNVBAoTFFN5bWFudGVjIENvcnBvcmF0aW9uMR8wHQYD # VQQLExZTeW1hbnRlYyBUcnVzdCBOZXR3b3JrMSgwJgYDVQQDEx9TeW1hbnRlYyBT # SEEyNTYgVGltZVN0YW1waW5nIENBAhB71OWvuswHP6EBIwQiQU0SMAsGCWCGSAFl # AwQCAaCBpDAaBgkqhkiG9w0BCQMxDQYLKoZIhvcNAQkQAQQwHAYJKoZIhvcNAQkF # MQ8XDTIwMDMwOTIyMzUzM1owLwYJKoZIhvcNAQkEMSIEIFjM/jlgnlk0vgxnUm9v # YgthSV11E9+eBmEmWaJ+f9coMDcGCyqGSIb3DQEJEAIvMSgwJjAkMCIEIMR0znYA # fQI5Tg2l5N58FMaA+eKCATz+9lPvXbcf32H4MAsGCSqGSIb3DQEBAQSCAQBtr0Cr # U5TSS1hv1DQ78WETB/bUVClrY8z0I2u5pekOEOEIAvPDxD8nvfy15E7Y5A4Z/GjW # OnqehwxNVxd7xzvqvQZgzILqqifMlkZZe1tO8/76I4BsBlDwjfH0nhc0nD+TJUay # D8QQakYSFFhzzeI40Xt5SBxhq+JnfqQvWgbw727PLCC7jFfReC+5JVErrKNOZt4w # yK5oJ6r8e2WfS8RuNT9tSeB9krvvKW138uSzufEvR3H3JilMKJN6aV/lNXt+YouX # un15n9DFB2r2sR/cvv+JElVZiaAGOcsIXzEvLOmlslEgK22D77rTK1+qVBRfFQix # is7wIggjGjomJg7A # SIG # End signature block