From 4f90385ff841ef6ef4e4f6bb257f458ef8ca5b15 Mon Sep 17 00:00:00 2001
From: "monero.love" <113195100+monero-love@users.noreply.github.com>
Date: Tue, 15 Apr 2025 19:43:34 -0700
Subject: [PATCH] first commit
---
Changelog.md | 101 +
LICENSE.md | 144 +
README.md | 361 +
classes.dot | 6 +
digital-art/FreeBSD-wallpaper-no-text-tm.png | Bin 0 -> 1202690 bytes
...arkmatter-titled-BlueWillowAI-assisted.png | Bin 0 -> 3529802 bytes
...er-2024-engraved-BlueWillowAI-assisted.png | Bin 0 -> 3536859 bytes
...D-Wallpaper-2024-BlueWillowAI-assisted.png | Bin 0 -> 3512567 bytes
.../QHE-FreeBSD-wallpaper-mid-text-tm.png | Bin 0 -> 1219496 bytes
.../QHE-Hardened-FreeBSD-wallpaper-red-tm.png | Bin 0 -> 1232993 bytes
...gineering Universal Digital Art License.md | 47 +
docs/FreeBSD-Hier.pdf | Bin 0 -> 360833 bytes
docs/SECURITY.md | 64 +
harden-freebsd.py | 407 +
images/harden-freebsd-logo.jpg | Bin 0 -> 112718 bytes
images/quadhelionEngineeringIcon.jpg | Bin 0 -> 6739 bytes
minimum.ini | 60 +
server.ini | 77 +
settings.ini | 74 +
util/mmap_protect.c | 45 +
util/pf.conf | 132 +
util/robots.txt | 17 +
vendor/spectre-meltdown-checker.sh | 7169 +++++++++++++++++
23 files changed, 8704 insertions(+)
create mode 100644 Changelog.md
create mode 100644 LICENSE.md
create mode 100644 README.md
create mode 100644 classes.dot
create mode 100644 digital-art/FreeBSD-wallpaper-no-text-tm.png
create mode 100644 digital-art/QHE-FreeBSD-Inside-Wallpaper-2024--darkmatter-titled-BlueWillowAI-assisted.png
create mode 100644 digital-art/QHE-FreeBSD-Inside-Wallpaper-2024-engraved-BlueWillowAI-assisted.png
create mode 100644 digital-art/QHE-FreeBSD-Wallpaper-2024-BlueWillowAI-assisted.png
create mode 100644 digital-art/QHE-FreeBSD-wallpaper-mid-text-tm.png
create mode 100644 digital-art/QHE-Hardened-FreeBSD-wallpaper-red-tm.png
create mode 100644 digital-art/Quadhelion Engineering Universal Digital Art License.md
create mode 100644 docs/FreeBSD-Hier.pdf
create mode 100644 docs/SECURITY.md
create mode 100644 harden-freebsd.py
create mode 100644 images/harden-freebsd-logo.jpg
create mode 100644 images/quadhelionEngineeringIcon.jpg
create mode 100644 minimum.ini
create mode 100644 server.ini
create mode 100644 settings.ini
create mode 100644 util/mmap_protect.c
create mode 100644 util/pf.conf
create mode 100644 util/robots.txt
create mode 100644 vendor/spectre-meltdown-checker.sh
diff --git a/Changelog.md b/Changelog.md
new file mode 100644
index 0000000..e3fb7f6
--- /dev/null
+++ b/Changelog.md
@@ -0,0 +1,101 @@
+## January 24, 2024
+* Change default umask to 027
+
+## January 19, 2024
+* Enabled pf firewall by default in settings.ini
+
+## January 17, 2024
+* After testing, re-introduced the Sendmail/MTA disable
+
+## January 16, 2024
+**New settings**
+Enhanced DoS/DDoS mitigation
+* `net.inet6.icmp6.rediraccept = 0` to prevent ICMP attacks. Only FreeBSD as a network appliance would benefit enabling this setting.
+* `net.inet.tcp.drop_synfin = 1` to mitigate TCP SYN-FIN attacks and stealth probing.
+* `net.inet.tcp.cc.algorithm=htcp` enable TCP congestion alleviation
+
+[H-TCP](https://www.sciencedirect.com/science/article/pii/S0965997821000399#bib0017) is a congestion control protocol for high-speed and long distance networks. It uses bandwidth estimation and changes the TCP window increase/decrease parameters according to the estimated minimal and maximal bandwidth. It takes into consideration that the parameter for additive increase should be small in slower networks and should be large in high-speed and long distance networks in order to achieve fast adaptation to the available bandwidth.
+
+DoS/DDoS mitigation via network performance tuning for high-speed network servers, used by default on Vultr FreeBSD 14.0 cloud servers.
+* `kern.ipc.maxsockbuf=67108864`
+* `net.inet.tcp.sendbuf_max=67108864`
+* `net.inet.tcp.recvbuf_max=67108864`
+* `net.inet.tcp.sendbuf_auto=1`
+* `net.inet.tcp.recvbuf_auto=1`
+* `net.inet.tcp.sendbuf_inc=16384`
+
+
+
+**NOTE**
+* `net.inet.tcp.syncache.hashsize, cachelimit, and bucketlimit` Were last updated for 2016 Computing Hardware and should be made tunable, currently they are read-only and serve to make SYN FLOOD DoS attacks easier.
+
+## January 8, 2024
+* ZenBleed workaround removed as it is now enable by default in 14 release
+* 32bit protections removed as FreeBSD is focusing on 64bit and in the future dropping support for 32bit
+ * PIE, ASLR for 32bit
+* Sendmail limitations removed since the 14.0 MTA in use is now the more secure Dragonfly Mail Agent
+
+
+---
+
+## August 22, 2023
+* Removed devcpu-data-amd as the re-worked port installs both AMD and Intel with command `devcpu-data`
+ * https://cgit.freebsd.org/ports/commit/?id=bc7829212d153aeff69b439d08e2e3001ef88ba3
+
+## August 20, 2023
+* Printing clean-up
+* Fixed error in microcode matching
+* Fixed Virtual Machine vs Bare Metal c shell bug in string matching
+
+## August 19, 2023
+* Zenbleed_workdaround.csh fixes
+ * at reminder fixes
+ * CPU Model detection fixed
+* AMD Threadripper Pros are still not being detected properly
+
+## August 13, 2023
+* Updated to give notice that no Zenbleed affected CPU was found.
+
+## August 11, 2023
+* The rc script has been updated for better performance and stability
+ * There is no positive value cases I can find for removing the chicken-bit during operation which on the contrary may produce unexpected results as with other workarounds of this type
+ * Rebooting without the rc script running returns the OS to an unset chicken-bit state which obviates the need to have a `rc` chicken-bit removal function.
+ * The user chooses the workaround or not without the rc script making available CPU state changes while in operation possibly inducing kernel crashes
+ * Simply using the `remove` argument and rebooting will return the AMD Zenbleed vulnerability -> MSR state to default
+* Fixed Syntax errors and word clarity in the main workaround file
+* Added a prompted reminder function using `at` to create a file in the home directory reminding the user to use the official patch due at that time and remove the workaround
+* Changed the user text notice after a microcode update for better security and stability
+ 1. Rebooting once should show clean startup with new microcode but still keep the tools in case of reversion
+ 2. Use the `clean` function to remove the conf directives that load the still loaded promiscuous cpu tools
+ 3. Rebooting again to load without promiscuous cpu tools
+
+## August 8, 2023
+* `settings.ini`
+ * `microcode_update_enable` set to "YES" in preparation for Zenbleed and Downfall Updates
+* AMD Zenbleed mitigation script was added
+
+
+## June 28, 2023
+* Changed requirements to be 13.1, 13.2 as this is when most security directives were added
+* Remove much conf syntax verification to work on all FreeBSD confs instead of just default installs
+* Reverted 64bit ASLR protections to 32bit since these were on by default since 13.1
+* `hw.mds_disable` was set at 3, AUTO
+* Removed `vm.pmap.pti = "1"` since this was on by default
+
+
+## June 27, 2023
+* FreeBSD hardening script /usr/libexec/bsdinstall/hardening sets `security.bsd.allow_destructive_dtrace` is formatted improperly with the flag without quotes as in `/boot/defaults/loader.conf` and man. Script sets it properly.
+* Test DTrace hardening: Using all 3 commands should result in `Permission denied` or `Destructive actions not allowed`:
+ * `dtrace -wn 'tcp:::connect-established { @[args[3]->tcps_raddr] = count(); }'`
+ * `dtrace -wqn tick-1sec'{system("date")}'`
+ * `dtrace -qn tick-1sec'{system("date")}'`
+* New setting `vm.pmap.pti = 0`
+* Setting `kern.securelevel` to `0` has no effect as FreeBSD will increment to 1 disallowing script execution. README changed to reflect this.
+* Error message conformity and clarity improvement.
+* Script now exits any time it restores a file to prevent partial writes and locked files.
+* Some sysctl.conf settings moved over to loader.conf section for better security
+
+
+## June 23, 2023
+* 64bit ASLR setting was reverted back to 32bit enable as 64bit is enabled by default.
+* `kern.randompid` works better if the number is manually set over 100 and is a prime [(*)](https://reviews.freebsd.org/transactions/detail/PHID-XACT-DREV-76pds6dxlcy5er6/)
diff --git a/LICENSE.md b/LICENSE.md
new file mode 100644
index 0000000..469bc1f
--- /dev/null
+++ b/LICENSE.md
@@ -0,0 +1,144 @@
+# Quadhelion Engineering Universal Software License
+
+[URL](https://www.quadhelion.engineering/qhelp.html)
+
+## QHELP-OME-NC-ND-HI
+
+**Legend:**
+
+* (Q)had(H)elion(E)ngineering (L)icense (P)ermission
+* (O)btain (M)odify (E)xecute
+* (N)on-(C)ommercial
+* (N)o (D)erivatives
+* (H)uman (I)ntelligence
+
+All entities are Universally bound by the terms and conditions of this license as it is inseparable to the Software using this license. This license grants no other rights than detailed herein.
+
+
+
+## Executive Summary
+
+Non-Commercial usage, retain and forward author and license data. Modify existing code as needed up to 25% while allowing unlimited new additions. The Software may use or be used by other software.
+
+
+
+### Section 1 – Definitions.
+
+* **Universal** is defined as all the states of existence. If exists, this License applies.
+* **Software** is defined as means used to produce a desired result on a calculating device accompanying and referencing this License.
+* **Creator** is defined as the natural human being that created the Software here designed in his mind and written down to Obtain and Execute.
+* **License** is defined as what all entities other than the Creator of the Software allows to be done with the software.
+* **Licensee** is defined as all entities other than the Creator of the Software.
+* **Obtain** is defined as having knowledge of the means used in the Software.
+* **Modify** is defined as making changes to the Execution of the Software in conformance with the existing Execution process in majority, utilizing the same data types of input and output originally used by the Software, retaining the intended use of the Execution of the Software in superset of subset of solutions, workflows, processing, intake, and production in general, but not in detail.
+* **Execute** is defined as having a calculating device calculate the Software.
+* **Intelligence** is defined as having the ability to solve complex problems with judgement.
+* **Human** is defined as Homo sapiens birthed from another living Female Homo sapiens.
+
+
+
+### Section 2 - Software Modification Allowance
+
+The software **may not** be modified in the following ways:
+
+* The Software logic itself cannot be changed *in majority*.
+ * The original *application* to which the Software *was applied* cannot be modified.
+* Changing or replacing of **more than 25%** of the existing programming code of the Software is **not allowed**. This does not include error handling, metadata or comments.
+* Programming language comments cannot be modified.
+* Metadata cannot be modified.
+* Author and License information cannot be modified.
+* You may not adapt, translate, reverse engineer, decompile, disassemble, or otherwise reuse the Software code, Software logic, or logic designs of the Software.
+* The Software may not be re-created or re-generated in whole or in part in another programming language or by any means except by permission of the Creator.
+
+**The Software may be modified in the following ways:**
+
+1. Any modification must retain the majority of functionality in conformance with the original Software.
+2. The Software can only be modified with the original programming language it was written in.
+3. The Software may be used by other software. The Software may use other software.
+4. Allowance of additional new programming code and comments to the Software is unlimited.
+
+**Examples of how the Software may be modified:.**
+
+1. The application of the Software is the computer systems and components to which the Software originally Executed; that being the data, systems, processes, inputs and outputs, and categories or types of computers, systems, data, I/O, and components the Software interacts with upon Execution.
+ 1. For example, if the Software Executes outputing Firewall rules and reloading those rules in a Firewall than it is not allowed to modify this Software to simply produce files that are distributed on FTP.
+ 1. Removing a Software function of only two functions is not majority conformance.
+2. Unlimited new functions and functionality can be added.
+3. Software logic can be changed without removing the majority of functions or functionality.
+
+
+
+### Section 3 – Scope.
+
+**License granted.**
+
+Subject to the terms and conditions of this License, the Creator hereby grants the following exclusive entities permission to Execute the Software which meet both the following conditions:
+
+1. Natural Human Beings
+ 1. Genus and Species commonly classified as *Homo Sapiens*, born on the same known world terra firma as the Creator was born on, being birthed by a Female Natural Human Being.
+2. Non-Commercial Entities
+ 1. Entities who are not profit motivated and are not substantially valued.
+ 2. All Corporations type Limited Liability Company (LLC), S-Corporation (S-Corp), and C-Corporation (C-Corp) are strictly forbidden from Software Obtainment and Execution and cannot be a Licensee.
+
+
+
+**License denied.**
+
+1. Non-Human Intelligences such as Artificial Intelligence, Generative, Language Models, or Generated Intelligences have no permissions to Obtain, Modify or Execute.
+ 1. Any computational analysis or automata characterized as Intelligence has no allowance or License to Obtain, Modify, or Execute the Software.
+ 2. Any sentience that was not birthed from a living Female Human Being has no allowance or License to Obtain, Modify, or Execute the Software.
+2. Patents, Trademarks, Copyrights, and legal or financial instruments, or applications to the Software, it's Execution, or it's License thereof is strictly prohibited.
+3. Derivations, re-creations, re-generations, and adaptations of the Software are strictly prohibited.
+4. Effective technological measures, Effective protective technological measures, and any prevention or limitation placed on the exercise of the Licensee's Execution of the Software is strictly prohibited.
+
+
+
+**Licensor.**
+
+This words and expressions of allowance and denial contained are here the License which in totality and in summary the whole of this formatted document is itself the Licensor. Adhering to the provisions of this License constitutes a Licensee. The Creator himself is not the Licensor and is not in contract in any way with any entity.
+
+
+
+### Section 4 – License Conditions.
+
+Your exercise of the Licensed Rights is expressly made subject to the following conditions.
+
+The Licensee must:
+
+1. **Retain** the License, usually the file LICENSE.md, with the Software.
+ 1. All information contained in the Software referring to the License and Identity of the Creator.
+ 2. All Author information including URLs, dates, emails, must be retained.
+ 3. This License file must be maintained at all times alongside the Software.
+
+2. **Indicate** the Licensed Software is licensed under this License
+ 1. Include the text of, the file of, or the URI or hyperlink to, this License, *pertinent* to any entity that is not aware of this Copyright, Trademark, Patent, or, License, of this Software.
+ 2. This includes requests, audits, inspection, or reviews in singular or in totality of all Software used on the Calculating Device where the Software resides, referenced, or Executed;
+ 3. The Licensee must make aware this License to all interested entities in the Software, it's means, functions, or results.
+3. **Obtain, Customize, and Execute** the Software in conformance with this License.
+
+
+
+### Section 5 – Disclaimer of Warranties and Limitation of Liability.
+
+Unless otherwise separately undertaken by the Creator, to the extent possible, the Creator offers the Licensed Material as-is and as-available, and makes no representations or warranties of any kind concerning the Licensed Software, whether express, implied, statutory, or other. This includes, without limitation, warranties of title, merchantability, fitness for a particular purpose, non-infringement, absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not known or discoverable. Where disclaimers of warranties are not allowed in full or in part, this disclaimer may not apply to the Licensee.
+
+To the extent possible, in no event will the Creator be liable to the Licensee on any legal basis or theory (including, without limitation, negligence) or otherwise for any direct, special, indirect, incidental, consequential, punitive, exemplary, or other losses, costs, expenses, or damages arising out of this License or use of the Licensed Software, even if the Creator has been advised of the possibility of such losses, costs, expenses, or damages. Where a limitation of liability is not allowed in full or in part, this limitation may not apply to the Licensee.
+
+The disclaimer of warranties and limitation of liability provided above shall be interpreted in a manner that, to the extent possible, most closely approximates an absolute disclaimer and waiver of all liability.
+
+
+
+### Section 6 – Associated files.
+
+Images and Digital Art obtained along with the Software are original works and automatically under International Copyright Law and may not be altered or distributed. Document files are original works under full Copyright of the Creator.
+
+
+
+### Section 7 – Term and Termination.
+
+If the Licensee or any entity fails to comply with this License, then the Licensee's and entities rights under this License terminate automatically and immediately.
+
+
+
+### Section 8 – Other Terms and Conditions.
+
+The Creator is not himself bound by these terms and conditions, allowances and denials, or any additional or different terms or conditions.
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..79e51dd
--- /dev/null
+++ b/README.md
@@ -0,0 +1,361 @@
+# Harden FreeBSD
+
+
+
+_Table of Contents_
+
+* [New Features](#New)
+* [Additional Features](#Additional)
+* [Installation](#Installation)
+* [Customization](#Customization)
+* [Settings Used](#Descriptors)
+* [License](#License)
+---
+
+FreeBSD officially defaults to [Permanently Insecure Mode](https://man.freebsd.org/cgi/man.cgi?query=security&sektion=7&manpath=freebsd-release#SECURING_THE_KERNEL_CORE,_RAW_DEVICES,_AND_FILE_SYSTEMS). This script will duplicate all the hardening settings run by `/usr/libexec/bsdinstall/hardening` and much more. Any directive can be set and re-set with a customizable `settings.ini` for administering, tuning, and easier jail management. All existing entries in all confs will remain untouched unless they are modified in the settings file.
+
+This script is also targeted to new users of FreeBSD so that they may leverage years of security contributions by the entire BSD community across all spectra, implemented on their system in seconds.
+
+Each of the security settings was researched, assessed, and chosen as a set of mitigations for maximizing threat reduction while minimizing restriction of system capability and availability.
+
+---
+
+For a more comprehensive true "hardened" solution with more security than this repo scope, which involves kernel modifications, I refer you to [HardenedBSD](https://hardenedbsd.org).
+
+---
+
+## Main Features
+
+* Makes backups of `rc.conf`, `sysctl.conf`, `login.conf`, and `loader.conf` on first run
+* Disables Sendmail service, but it can still be run by command and abused.
+ * **Recommend**:
+ * `rm -rf /usr/libexec/sendmail /usr/libexec/dma` OR `chmod -R 000 sendmail dma`
+ * `pkg install opensmtpd`
+* Sets passwords to blowfish encryption, which **is** better than SHA512 for this purpose
+ * [Okta Medical Device Authentication](https://auth0.com/blog/hashing-in-action-understanding-bcrypt/)
+ * [Security Stack Exchange](https://security.stackexchange.com/questions/133239/what-is-the-specific-reason-to-prefer-bcrypt-or-pbkdf2-over-sha256-crypt-in-pass)
+ * [Silver Stripe, Census Gov Contrator](https://docs.silverstripe.org/en/5/developer_guides/security/secure_coding/)
+ * [Google Engineer Gregory Gains](https://www.gregorygaines.com/blog/how-to-hash-and-salt-passwords-in-golang-using-sha512-and-why-you-shouldnt/)
+* Sets passwords to expire at 120 days
+* Removes `other` write permissions from key system files and folders
+* Allows only root for `cron` and `at`
+* Primitive flag verification catches simple errors
+* Modularizable within other tools
+* Automate any shell command
+* System Logging to `/var/log/messages` and Script Logging to `/var/log/harden-freebsd.log`
+* Pretty prints color output of script execution to console while running
+* Sets umask to 027
+
+---
+
+
+### Includes
+* Desktop Wallpapers as a special gift to users of the Software
+* Directory (Hier)archy Visual Map, PDF, in /docs
+* robots.txt to deny AI use of your intellectual property, with inline `nginx.conf` format and commented section for use as a plain txt file
+* Robust firewall settings for pf
+* You can grab icons and more Wallpapers at the [Quadhelion Engineering Development Gogs/Gitea Git Repo](https://quadhelion.dev/elias/bsd-wallpapers)
+
+---
+
+
+### New Features in 3.1
+* A package audit is automatically run identifying vulnerabilities in installed packages and saves to file `pkg-audit-report`
+* Security Tiering has been introduced with additional settings files minimal and server
+* A script argument can be given naming the settings ini file you wish to use, mainly to toggle between secure and minimal, otherwise settings.ini is used
+ * A minimum security and high performance server tier ini files are now included
+ * Adjust as neccessary or make your own set
+* A script argument of "restore" is now available, overwriting the changed files with the original files saved during first run
+ * rc.conf, sysctl.conf, and loader.conf are restored. `login.conf` and the password changes are not reversed, neither are file permissions or at, cron adjustments
+ * `minimum.ini` does not have `first_run = True` set as it is expected to usually run secure. Therefore if using this ini file first, **backups will not be made**.
+* New wallpapers have been added with the assistance of [LimeWire BlueWillow v4](https://limewire.com/features/bluewillow-ai) Artificial Intelligence image generator.
+* Change the default umask to 027
+---
+
+
+## Known Incompatibilities (Insecure) 09/7/2023
+* **VM**:
+ * VirtualBox Shared Folders
+* **Workstation**:
+ * **Firefox, Chromium** explicitly use [shared memory](https://www.usna.edu/Users/cs/crabbe/SI411/current/security/memory.html) allowing data access between private and non-private windows, tabs as well as other currently running apps.
+ * Conflicts with `kern.elf64.allow_wx`
+ * Linux Binary Compatibility
+* **Server**: Nginx
+
+
+### Verified Compatible
+* **Workstation**:
+ * Librewolf, Qutebrowser, Transmission, Evolution, RhythmBox, VLC, Abiword, Gimp, Inkscape, Spacemacs, Git
+* **Server**:
+ * Apache (w/o memcache), OpenSMTPD, MariaDB `have_dynamic_loading=YES` (with plugins)
+
+
+---
+
+
+## FreeBSD Security Advisories
+https://www.freebsd.org/security/advisories/
+
+**FreeBSD Update Procedure**
+
+ ```
+ root@freebsd:~# freebsd-update fetch
+ root@freebsd:~# freebsd-update install
+ root@freebsd:~# shutdown -r +10min "Rebooting for a security update"
+ ```
+
+---
+
+### FreeBSD 14.0 Security Changes
+* New [Mitigations Manual](https://man.freebsd.org/cgi/man.cgi?query=mitigations&sektion=7&format=html)
+* New Kernel Address Sanitizer
+ * [KASAN](https://man.freebsd.org/cgi/man.cgi?query=kasan&sektion=9&format=html) is a subsystem which leverages compiler instrumentation to detect invalid memory accesses in the kernel.
+* The **Zenbleed bug affecting AMD Zen2 processors is now automatically mitigated** (via chicken bit), preventing misbehavior and data leaks on affected machines. If needed, applying the mitigation can be manually controlled via the machdep.mitigations.zenbleed.enable sysctl(8) knob. Please consult the new [mitigations(7)](https://man.freebsd.org/cgi/man.cgi?query=mitigations&sektion=7&format=html) manual page for more information.
+* Position Independent Executable (PIE) support enabled by default on x64
+* Address Space Layout Randomization (ASLR) is enabled by default on x64
+ * To disable for a single invocation, use the [proccontrol(1)](https://man.freebsd.org/cgi/man.cgi?query=proccontrol&sektion=1&format=html) command: `proccontrol -m aslr -s disable command.`
+ * To disable ASLR for all invocations of a binary, use the [elfctl(1)](https://man.freebsd.org/cgi/man.cgi?query=elfctl&sektion=1&format=html) command: `elfctl -e +noaslr file`
+* A workaround has been implemented for a hardware page invalidation problem on Intel Alder Lake (twelfth generation) and Raptor Lake (thirteenth generation) hybrid CPUs.
+* The default mail transport agent (MTA) is now the Dragonfly Mail Agent.
+* Support has been added to the kernel crypto for the XChaCha20-Poly1035 AEAD cipher.
+* The process visibility policy controlled by the `security.bsd.see_jail_proc` sysctl(8) knob was hardened.
+* The process visibility policy controlled by the `security.bsd.see_other_gids` sysctl(8) knob was fixed to consider the real group of a process instead of its effective group when determining whether the user trying to access the process is a member of one of the process' groups.
+
+---
+
+
+## Additional Software
+
+* Scripts included to verify the implementation. Run before and after the hardening.
+ * Kernel vulnerability diagnosis provided by [Stéphane Lesimple's](https://github.com/speed47) spectre-meltdown-checker
+ * `cd vendor`
+ * `chmod 750 spectre-meltdown-checker.sh`
+ * `sudo ./spectre-meltdown-checker.sh`
+ * You should only be left with the MCEPSC, Machine Check Exception on Page Size Change Vulnerability, [CVE-2018-12207](https://www.freebsd.org/security/advisories/FreeBSD-SA-19:25.mcepsc.asc)
+ * MMAP, MProtect vulnerability diagnosis provided by [u/zabolekar](https://www.reddit.com/r/BSD/comments/10isrl3/notes_about_mmap_mprotect_and_wx_on_different_bsd/)
+ * `cd util`
+ * `cc mmap_protect.c`
+ * `./a.out`
+ * You should have two successes
+
+---
+
+
+---
+# Main Details
+
+## Requirements
+* FreeBSD 14.0
+* Python 3.9.16
+
+
+
+## Installation
+
+**WARNING: Once kernel level 1 is set by this script, you will not be able to modify these confs again with this script until it is set to -1 and rebooted!**
+
+* Set `kernlevel = -1` if you want to test various setting groups with your applications and network
+* Customize `settings.ini` to whatever is needed, the script will change the directive to your flag
+* Set permissions `chmod 750 harden-freebsd.py` to prevent shell injection from another account or process
+* Set permissions `chmod 640 settings.ini` to prevent shell injection from another account or process
+* No `settings.ini` section can be entirely commented out nor be completely empty
+* `sudo ./harden-freebsd.py`
+
+
+## Conf File Verification
+
+`kern.vty = "vt"`
+
+This script does primitive verification of the confs flags in strict accordance with system man. Many online tutorials even on the FreeBSD family of websites do not use the proper syntax. Check the log for any validation failures. Use proper syntax, remove the syntax checking lines 241-261, or rewrite the regular expression to make a new check suitable for you.
+
+* For `/etc/sysctl.conf` the script checks for no quotes
+* For `/boot/loader.conf` the script strictly verifies syntax from man and `/boot/defaults/loader.conf` syntax
+ * All directives in these sister confs must be in quotes
+
+If you do get stuck in read-only single-user mode and need to correct a configuration file then use:
+
+```sh
+zfs set readonly=false zroot
+zfs mount -a
+```
+
+
+## Customization
+
+#### pf.conf
+pf is now enabled in `settings.ini` by default but not in `minimal.ini` or `server.ini`. You will need to edit the macros with your interface, SSH port, and IP addresses before use. `admin_ips` is used by default and will take a list of two IP Addresses seperated by a space, `admin_ip_range` is included for convenience. If you will be using the range macro instead of the default make sure to edit line 108 changing `admin_ips` to `admin_ip_range`. Redis is configured to be localhost only.
+
+
+#### Backups
+
+The very first time the script is run it will make copies of `rc.conf`, `sysctl.conf`, `login.conf`, and `loader.conf` named `rc.conf.original` etc. If you've already done this yourself you may want to rename or move those files. After the script is once run, it sets that field to false and no longer makes backups. If you would like you can set `settings.ini` section `[SCRIPT]`option `first_run` to `True` with capital `T` to make new backups at any time after you've renamed the original backups or the script will overwrite them.
+
+
+#### Chmod-ability
+
+The set of files needed to be secure changed and changed throughout testing and so it ended up as a shell command but an error checked function was provided for the administrator programmer to use instead of appending to the long list in `settings.ini` section `[FILESEC]` if you wish or to work with other software.
+
+Those files are:
+
+`etc/ftpusers /etc/group /etc/hosts /etc/hosts.allow /etc/hosts.equiv /etc/hosts.lpd /etc/inetd.conf /etc/login.access /etc/login.conf /etc/newsyslog.conf /etc/rc.conf /etc/ssh/sshd_config /etc/sysctl.conf etc/syslog.conf /etc/ttys /etc/crontab /usr/bin/crontab /usr/bin/at /usr/bin/atq /usr/bin/atrm /usr/bin/batch /var/log`
+
+#### Secure Password Settings
+
+The newly applied settings will not take effect until you reset your password.
+
+---
+
+
+
+
+# Setting Descriptors
+**Startup**
+
+* `kern_securelevel_enable = "YES"`
+ * Enable access to other than permanently insecure modes
+* `microcode_update_enable = "YES"`
+ * Allow CPU microcode/firmware updates
+* Disable Mail Transport Agent
+ * Despite the documentation saying "NONE" is deprecated, this is not the case and hasn't been for over 15 years.
+ * These are *thoroughly* tested as the best settings as "NONE" produces one less WARNING than "NO" in some cases.
+* `syslogd_flags="-ss"`
+ * Disallow syslogd to bind to a network socket
+* `clear_tmp_enable = "YES"`
+ * Clear the /tmp directory on reboot
+* `icmp_drop_redirect="YES"`
+ * Disallow redirection of ICMP (ping, echo)
+* `inetd_enable = "NO"`
+ * Disallow Network File System to share directories over the network
+* `portmap_enable = "NO"`
+ * Disallow portmapping since Network File Systems is disallowed
+* `update_motd = "NO"`
+ * Disallow computer system details from being added to /etc/motd on system reboot
+
+**System**
+
+* `kern.securelevel = 1` [(*)](https://man.freebsd.org/cgi/man.cgi?securelevel)
+ * The system immutable and system append-only flags may
+ not be turned off; disks for mounted file systems, /dev/mem and
+ /dev/kmem may not be opened for writing; /dev/io (if your platform
+ has it) may not be opened at all; kernel modules (see kld(4)) may
+ not be loaded or unloaded. The kernel debugger may not be entered
+ using the debug.kdb.enter sysctl. A panic or trap cannot be forced
+ using the debug.kdb.panic, debug.kdb.panic_str and other sysctl's.
+* `security.bsd.see_other_uids = 0`
+ * Disallow users from seeing information about processes that are being run by another user (UID)
+* `security.bsd.see_other_gids = 0` [(*)](https://docs.freebsd.org/en/books/handbook/mac/#mac-policies)
+ * Disallow users from seeing information about processes that are being run by another group (GID)
+* `security.bsd.see_jail_proc = 0` (Sysctl MIB Entry `sysctl -a | grep security.bsd`)
+ * Disallow non-root users from seeing processes in jail
+* `security.bsd.unprivileged_read_msgbuf = 0` (Sysctl MIB Entry `sysctl -a | grep security.bsd`)
+ * Disallow non-root users from reading system message buffer
+* `kern.randompid = 107` [(*)](https://wiki.freebsd.org/DevSummit/201308/Security)
+ * Force kernel to randomize process ID's using above salt value instead of sequential
+* `net.inet.ip.random_id = 1`
+ * Randomize IP packet ID
+* `net.inet.ip.redirect = 0`
+ * Disallow ICMP host redirects
+* `net.inet.tcp.always_keepalive = 0`
+ * Disallow keeping open idle TCP connections. This may need to be changed if you are serving
+* `net.inet.tcp.blackhole = 2` +(UDP)[(*)](https://man.freebsd.org/cgi/man.cgi?query=blackhole)
+ * Packets that are received on a closed port will not initiate a reply
+* `net.inet.tcp.path_mtu_discovery = 0` [(*)](https://man.freebsd.org/cgi/man.cgi?query=tcp&sektion=4)
+ * Disallows TCP to determine the minimum MTU size on any network that is currently in the path between two hosts
+* `net.inet.icmp.drop_redirect = 1`
+ * Pairs with rc.conf startup, as once enabled, it is then set
+* `net.inet6.icmp6.rediraccept = 0`
+ * Disable ping IPv6 redirection mitigating ICMP attacks
+ * Set to 1 if using FreeBSD as network appliance
+* `net.inet.tcp.drop_synfin` [(*)](https://www.juniper.net/documentation/us/en/software/ccfips22.2/cc-security_srx5000/cc-security/topics/task/configuring-tcp-syn-fin-attack.html)
+ * Mitigates probe scans and has positive impact against DoS/DDoS attacks
+ * Quadhelion Engineering [Research](https://www.quadhelion.engineering/articles/freebsd-synfin.html) on this setting
+* `hw.mds_disable = 3` [(*)](https://www.kernel.org/doc./html/latest/arch/x86/mds.html)
+ * Enable Microarchitectural Data Sampling Mitigation version `VERW`
+ * Change value to `3` (AUTO) if using a Hypervisor without MDS Patch
+* `hw.spec_store_bypass_disable = 1` [(*)](https://handwiki.org/wiki/Speculative_Store_Bypass)
+ * Disallow Speculative Bypass used by Spectre and Meltdown
+* `kern.elf64.allow_wx = 0` [(*)](https://www.ibm.com/docs/en/aix/7.2?topic=memory-understanding-mapping)
+ * Disallow write and execute for shared memory
+
+**server.ini**
+
+Common network tuning values to increase performance and alleviate congestion, useful against DoS/DDoS attacks on high bandwidth application servers
+
+* `kern.ipc.maxsockbuf=67108864`
+* `net.inet.tcp.sendbuf_max=67108864`
+* `net.inet.tcp.recvbuf_max=67108864`
+* `net.inet.tcp.sendbuf_auto=1`
+* `net.inet.tcp.recvbuf_auto=1`
+* `net.inet.tcp.sendbuf_inc=16384`
+
+
+**Kernel**
+* `security.bsd.allow_destructive_dtrace = "0"`
+ * Disallow DTrace to terminate processes
+ * Test DTrace hardening: Using all 3 commands should result in `Permission denied` or `Destructive actions not allowed`:
+ * `dtrace -wn 'tcp:::connect-established { @[args[3]->tcps_raddr] = count(); }'`
+ * `dtrace -wqn tick-1sec'{system("date")}'`
+ * `dtrace -qn tick-1sec'{system("date")}'`
+* `hw.ibrs_disable = "3"` [(*)](https://wiki.freebsd.org/SpeculativeExecutionVulnerabilities)
+ * Prevent Spectre and Meltdown CPU Vulnerabilities, 3 for AUTO
+
+
+---
+
+### January 17, 2024 Changelog
+*If you are on FreeBSD 13.2 download the 3.0.1 release tag*
+
+* pf enabled by default
+* ZenBleed workaround removed
+* 32bit protections removed
+
+
+---
+
+
+*Full [Changelog](Changelog.md)*
+
+
+---
+
+
+
+## License Summary
+
+### Software
+Non-Commercial usage, Human Intelligence only, retain and forward author and license data. Modify existing code as needed up to 25% while allowing unlimited new additions. The Software may use or be used by other software.
+
+
+### Digital Art
+All Digital Artists and Original Digital Art automatically receives robust International Copyright protections.
+* Supplemental License [here](digital%20art/Quadhelion%20Engineering%20Universal%20Digital%20Art%20License.md)
+* QHE Wallpapers meet the [FreeBSD Foundation Trademark Usage Terms and Conditions](https://freebsdfoundation.org/legal/trademark-usage-terms-and-conditions/) where most FreeBSD digital art does not.
+* An original digital art creation containing the FreeBSD Logo under T&C, the larger work is thus automatically copyrighted worldwide and may not be distributed, shared, or altered.
+* FreeBSD Foundation Members, Employees, and Associates are exempt from Digital Art restrictions.
+
+
+
+## Security Guidelines
+
+Since this Software uses shell commands it is required to place it in a secure directory with permissions on the **parent** directory to have no permissions for `other` /all/world group to write or *execute* and **no network access**.
+
+Please follow [these guidelines](/docs/SECURITY.md) should you find a vulnerability not addressed in the audit.
+
+
+## Statement of Security:
+
+* **Risk** - Low
+* **Impact** - Medium
+
+This script has no networking, accesses no sockets, and uses only standard libraries.
+
+Although this script is using `subprocess.run(shell=True)` the only possibility of shell injection is from the paths customized by the Licensee or unauthorized access to the filesystem the script resides on in order to perform unauthorized modifications to `settings.ini`or the Software which is not a vulnerability of the Software.
+
+
+### Latest Development Version
+
+[Quadhelion Engineering Code Repository](https://quadhelion.dev)
+
+
+
+
diff --git a/classes.dot b/classes.dot
new file mode 100644
index 0000000..e1255a2
--- /dev/null
+++ b/classes.dot
@@ -0,0 +1,6 @@
+digraph "classes" {
+rankdir=BT
+charset="utf-8"
+"harden-freebsd.Conf" [color="black", fontcolor="black", label=<{Conf|file
flag
found : bool
setting
|addConf()
checkConf(): bool
restoreConf()
setConf()
verifyConf()
}>, shape="record", style="solid"];
+"harden-freebsd.SetOpts" [color="black", fontcolor="black", label=<{SetOpts|section
|}>, shape="record", style="solid"];
+}
diff --git a/digital-art/FreeBSD-wallpaper-no-text-tm.png b/digital-art/FreeBSD-wallpaper-no-text-tm.png
new file mode 100644
index 0000000000000000000000000000000000000000..52a0e6d2bd2ebeb0e583622faf62fb437310665e
GIT binary patch
literal 1202690
zcma&N1yChT(k_gEt8>%y^$%ChpodW9R!45$iuCuZIBH-*S0B|NnIx
zKt}R6i;J}YnWmf~iKxAkDG3J?2NN@yARGz5lZhFxGEn?~8h_RV$Sho39C!f$cXxLt
zcQz(_CvyM`4-XH3nH9jw%J|8_=Wh=0fcnmQXhSvt5_+S`%*CDYKz
z-ql5bjO>$6@=wid9sVWU&iQ|={~QN^hoJ+2g^3yP@5~Ms_Ad6$7WV&#CjTP;S3?uy
ze|6&E>SXh`{wBr%QyWuTQ#%*uPkxsF=*ZN=@_%jq54HZH{FitaOSAt2`(Kp*V*m7w
zoZP<@`VaB{wA$A8KlE{S5p(+-xc_m&|8EOtRZj;~fU>Exy{nV4shHcRUF3g{-DhvS
zqE4oUE~dcGOMr}(nU#%^nVXTBN0o(xmz|TBjg^s^i<$Xf%yRZ7mS&#+&CJcq%E`;h
z^U2Kn@7$l^WMb%I`2WKHF9-4d#r+SZK12Ecs?q7TOxCjI3n
z8`r-khMJw_r)OFJR`PF>=KsL#`3TE#%p6}XD&eI!DwP?X6S0;LMABgWNIp+0%UYIw6Sq8bTD;dw6kY)G4*ia
z2mCc*Z7lys$1|^_rL&8@ljpzbpknIypE~?K?@37hj%Hp%S@~Cr
zHnsZUTHmW?taLf
z?K}t)NK|JNkAY@g>L5aTOj&C6EIEgzzH6NQMqP=wY(axjT-mu{)UfTEr&jgc>R;nX
zYghi&87{6oGZ#A-1*vwI<6Cpc%ABf;)FZG(BMlyIL({8zUa2e{>u~VL{(A7fD|aW2^>~Q4PJmNv7M8r~N_uOg!^9TbfGI&nGFYgQS)-2nam-Ul%AyW;PB8
z2nmQ3P*~L?d$rRuiDK9ha7dIfKYUBD*0YHd4>F2bB6PbT`;&fU>QbMB?;AUEm4>L;CshO@bl)xLtgNg+nL)?^wH`>;coo!8
zP(0sXpRR5WPGJVY#N838^{t|C>a)kKcNT_D!PO92SbkoZrrL}joO-OVjqN`OjM-!E
zHnB3(KYmj}%?S3Fax_Ej`ccAQW=6J+raUd2B>uhLYKLPeL~h?6Yy{#>#Kqm--rOA8
zw|$5Vj34UkQ}bp+w(Q5PmK>O!@oa5Q!?@6pdB%mUG+m#Yk&K8C))mH80{q5u+~j1q
zaB_`NOOS_{2!4|mH>%;dt$2<^)3=Bl{TbP?ps7Hm-(?OYGQqz=Z1Yp+P?k3~HkQ`j
zUbAj72MYCfH!vb
zf~CoV9v{B)6_w?51I}HmKKxfV%l$<%Wpwfxt!PuLq#!bCW1>`ba~B(s9hD_LFr@}Ce=Iicic|$ysKr+*h*4SnvNGL#
zbj&1&j5`d-Z=vH?yVP|(w3X&9#%TiY7xXHp1prr7qeNpw)oT(y)LNjcS^hp}SS=w_OWY(}
z$ZjK0tSc)$^A-fR8z4F>Wib&%i~DB5X=QN3YlX4Wku)=b=y4rb+8fpyse)3tERjCW
zXarI?q*IbO(Ls}5)nBCpv0PR9`%1(!BL0#+Ed#7j4)l~?CAi>*n)HgIKNQioWf`nm
zF;rNKN~dR4;^!F!rp&@~R##JVv-`#So8ya}2yv_$=R6J!3O2nRX}hDZl*BaKHx8$Og^YrQcy
z5(;^O?JX_kgwcVL2IAioLaY-yj`#v82wra}UA>hc~Z;%<{P1Der
z$`#~r7nSfmsxYw;C>zC&p#!AM=;5)&)ibAv&A_Ak&d)Url?YDKop>X%H3kAY?4Zmb
z{e?wXxf1)4x4&jYh~WwKf1ypt*c>;>_6d{A(@M;yEMbP$yM*bd&|aTl818HxWM8G$
zl-z%VMpo`?EH1PNf(8FlN&?fNc+)WfSqn+$Dj6n6$K&z4hX!n$#X4l1LKBvE_*=0=
z0+9v9cE*4yW!k1v9`4Efp6AU-Nq!}Hw@
zD>Er7JewDakcF1R>?cJjjtDTGqpEbkCOMOpTzJCqu2D*wIrW!PkUT!Pn$J$x*E+i2
zFeITC`50ExwTsn+MNayywn4MS&7-&r!7e%1>|bUroE!@ZZIc(N{b>(eoGAw=SZ@W;
z%lM0HY{%)Ow?e*RY1)wzqyzmqblHUGl?{JH(#jPo#^}%PUWt-5@i4a7JCAtwR|FKD
z&48p!mS4PZZFr@JgUSW4;dK(~)QVuPJkD;
zS~{Yw#GKblPaV&Oe>fcwr@S0!hDe&y(>G%Fborka&
z$jsC3MfA>pHYK$@d5nAaY-VP2NI}Fi(I3B0>H@0(|8$!!%AY&WqYba(!ejG9ByZ{M
z?(S_(UjpPw0>9}OJuYbLkhePMCw|Sp;1#-1rtlsS67$ljTU5y9M=f6#mjv!n=IE^R
z4^F%sEL)H6Iz?NMkH@Z5?6{Vu8|5urIR*O^yDly^y6rc$f^pZ!
ziHtoRADnOjDS6vOP?EiT+_^C2{
z8^gn!2B^WjTk#%!M_9_aXy-x;lRuo<$ye#DwZ&|j@k)UKjc|#&Xba1Dcd(C22cNGo
z_WXbRFNb>1&(E*6wut>c!jXlZ2ak>_#566kv2_-PMN(4p+@;b&(aPs~8d}8$D3rU`
z(&p#{RV{dnOP{`A{y82GdNP<0U>Tv9Q$AL+A5HIvC#r$KEHjk-^F#bA!>uI)eox_C
zW$p6D;~Xp5M~D7Fm$`(-5ybx2Dysbvwfb9$`aLFMKBojMYDDcLErCK
znI$M~3TiqlJ4xv%EE76g`%C&n6T$Dc1OsXm)OcHEnNy`M>x2aP*ZT*o88^5t=0BwKn!pD
z;~-Yz90;$B`^_j=JtzvdvvB3vfcAPV^hYdU##;gIaC0VZ2qc%96jGnoaF
zjQSsjR(=j`+S3Zg2=rsOYYwIvI(Dy|{dJDpM8lK5xcBeIOycQlot<3kJ~tPB_iP3h
zZ4B*C=^-#(hR>(wRBDd0BmT(=T>S}$eKQI`GA9=o7au31+}Zlsm2B5>092pn0rp$X
z*_r#gXLxp}k-E8ZZHR1;LBWuf(2*alMw3+*0gf`4nGvJ>3g1MCI@;1NR%SiNxK}Z#QmUzet2LRX
z{f%GA%kE~COHiwd@0hQ&=0i{0mI9qCImhDwHF&JxDh?S-i~+3`lHbsA8VeajnpOjU
zt}fg!yuZKq_TqcHyD7*k2)*wN6ThEy`?)_NWSA9v<44G;^@o1TcgaO$V4$qtce^QD
z#&9)KJ`PEOq{^HRc6x}6(UypljVo%gip>12qz9u&3_f?gJLFTLS$7bq8do^!dZ
zfP3=@ED6gg^hv1BLUH7vmvF)j5id-b$HS-hzFY8^nzR{K2cK@FYwkiv{Sj+hpe_gR
zBA*;lYhSA{IT`y|;$rRW?C=~wS$W(WHRdZ3`X?XzQFY0bz&UZMh$^S>^j1}ZT2ufX
zr&|($_iU$q=4iML@5?XOiWANHbAHzc5H7cFj0
z0d#y9R(=z+B`OF#RmVEwO<{Kj<2cQ1EHd)P?I1SC&DLPS;8rtdq$Y>^0Tf<(+P+~D
zR+w2NyOeenJ3y%=Rg(Re0>W$uSf}H}G3F2Hwpm54pnQx1$f_zFHPwK*2fp_9s(CsV
zg~3U!H>>%ngXv!d_4`bG^R)c5s6ITx)LaDq(QG
z3pPs#-#Jn-?Zd1lbIRKLIzV%II65Y=Fda^Edmy_P|IA9RmKMbP(Udk;=$6RQu`j
z)$K0dh1d_V*)X}hN6H_VlTL!m8Vz$Y)p6WAT{y)+6%+5G>~y{g3&=De5PP6+swY&l
zpHN~?P~Ybf-t#VlUBD(a3T0en&NmVe@n1|2+q8QbIV(!|eUT77r@!lP$Buy0&JL2c
zFur$^8b?zUbAP_ZCnQw2bP#3On!T|=sPaP7W05ifUs62nO5yCqnV3kWUAD4!cXu@!
z*(|8^g>tnS=YS=P1~3+J{8_fQuP4vt4`0@
z)JU#X6Eq%1=9Jd=lhJd~*l8!=YI_#i_0+m1gXauDIl3XSZLrL(7kFh^
zblX`naB^hmwYMr%DVzJ$@|nb78E5q<>BO_?biVKF(W`@`C@3t(EiNv`b^E@a?F{Qw
z&G){)EBHUpc0Xlxx3+XVp59Cey*^EKzaLwpqL#)Mt5u4mrf&5(K28mqL~I_C;*?hM
zXqrgYEc9oI61IVvOqb4YmwU=?sU6_z8Qsz_keOkCRIgqOGdqqWQ`ywE(pddM5f-no
z1kGM$Xn~MAi+-Z|YCkYb#;9ONB^$CLvssWRIzNxY&7(OtI(Nr!7h`3Y6A`J!
zdM7X%|Fik|&TGweoZ(IanYLyH_C3)_-t$#3dFVjvF&SGU{Ho8ybv&9PfU9jFl$MX#
ziP)gDnbWUDIN696i+$#Pj5KZH3phvhH?aU5arXt{m2#c
z8(xaYAKwzJqhgGB>flj$_U3T)>Q?4v=T3GpC(IG;)Om_YP8iTNKx4>s^$c>dbBTxv
z1%w2TO
zTSGRMu@=H1f4}RQ>Uud}sq11reR^yn8LOGV$;}Qsh!3~&$0X_q4_$^|$~wstHQnCQ
z)kRvmaSr3mmq$&M!@|KAH>VOqaUf@jj7T3w=WMG@O0=UI-X-9PTM!L9-op)Wv^joh
z-tY!w*E`>HjL?dF%OShHJ#yz-T!ep}st9U?>I-bvzPU@~0f4S@uJ_6AO#uehsV1#Q
zx-uV~`x(grsWwd;v&Pig$QF_SeL|t*&7~C@L5H%yABLg
z-=m+KRg!a>{8$96BVFptile{_|I6O8Jm345jW;_2YkfSP=JI)+5l_lv1-`5P7+p7+
z{01e>#OTS*n@!P41K+1Tn83&sEI>ec!r+Br%j%H15O>rqfzvbdO@&9{Qt_b62jYqZhazHNY_6g$P=sMF4U~$G)3Bfoy|Zst?H#12MiCnVLD?y0Z?gz-uF%7*
z$4J&PL%7j2Sr6Lv1LJiI0z4axlk*tpV=59rT}xbrA+~bnvDare??21m#*}Tbr7&8K
zjQm_P|M!Etx3jbT)13ysZ+8;JzPI5*?=P)>@#?6RHx-~dp|U;T!ZzPC8LEi(#`#U>
zRp&VsVf704yQ`fPzmWAhnYoVyq&LH0>D2p0<~f$(ty^CXkb7C1NptK>EsJTlirg`&
zu;|5a-hc?~mFBWnJ0HtUD=FZf84f2dXh}Lr5Af=!urC4IalO!vUe2GbIy(il9dVq_
z`GERK%Mf*ByV+$pgX6SEx@2fJ*yO(uq$mL2XZKE(UqmK`LwFibTkrx^j@P|T7)P~O
z)N{~x+1;fKyvIvZGem4LiUp0U6vfiBbidFjqKbR)r+{&*2xCtF+~tU}fp83;X9jB5
z>g$c9lQ|Y)QMGlnaPtTW@bmKW_~nN8O5oLD#hFut#}#Q7V@vIge)j~xi*d4IR7E(8
z?zjBduTr1=gE*;p`9+p_;m^5{2Qxx&idcvgA%o~1f(4nCghL1&%EM2usc;=6BYyZF
z8B5l4c&w@LUjXb5!4e2#Zejt$8$LI;EA|JVJ1zGja%9ArI#gJiC5XG3MO|BvPGf97
zOfJWezZ038NAA2qA|a6ZXpgTlks%QVxkM4XouxHxZO=|mZ>uoBeU01_>0nkGqUn{*
zYh~tb_Dg@CUs%Yx=sFqwE{N}Fr@!&bkkH}v_3`vHn!x9fEo&-t@7`QSfPNDf9zC;oT0#gOGch|H2`;an;Feut9|_qJ
z+Wh4~SIp;%djaM=S&#}4RN-|3*LNB4cD}w=Q>I2UA={78l>zf-q%Gg2AlYK&NqMJd+_2r?sjFSUhYW>yAo+iJaoYuUWV~
zrxI$l?GsN)Sr<_3abPiWHw=R)mirw%ZDoFN=DzV%_VM!J>F3plx;9NYer#i=+amkY
zdgKYu8#>Y%hcx>u{S<`?_33&Ha5WsHIwhLEgpl4?-J?ZDYAonm%1zqlezD%$3tFHt
zUUFGz3`cV;jAqET4u8G0qh(eW&2s>Hk^`^#%kx_+y`$fV)30&hN}_WWvFdC3sHBmA
z@OL_3^6UVq3SCsJK7j_NwM!G7QY0z|$P%D!Rk1*jUT>y2i-Cj|9F`3}noy~e9emb<
zCOJCohh{Dq!ZI3>XfPmY#N@y+A`e+}P`219lxm~qQ54ZiFQYt&c{k3630rT2_>`D{
z;B=$Y+g)H6kn8hOW$>}z-2Hwx@1+;hx4R!pgD*F?^t~cSQyPYhil~%pe}362%;sA1
z_hv?X(dm#Nz3D~fys${hSwdAS}qhXaBs_Da@FU)XB7INX6&OiU)IQ(MWAHEY#$~7MH&b8U2!G3c`%_=jUGu_JA@Vk+t%Jqvt0Jk!%>+z^g
zXuiS~Z2az_87_F&azzSP(8e|#XJ?l2)#Gtj;ybY>|AIa`|4h1i`95PzCu>=9bO3=y
z6h-nkZir{n!m+V$2h?T5!{Ngc!^&`R^o<@SS~lc&(VnriUunvC5bEA}DT>~%VXsQ8sS+$LSl2lAe@Ka>}l5vpoMZB)RtS%r9b1O)hUTu4ESlIWeF{;?_3>~-(^=~>E#2aS
zRLYz$)q=@##mk&thpX^~*iEvr%$9n56~ZfrfMMNN4q?*}8ueW+wlr5%?tCyfBG0)N
z)`FBQA(VhU#kA|rx=UP;?RRPBRnSxibfRl~foFfZ)WrDbHmGaVS{p92B-T&#EjlSC
zGF*i3xcl~`zjZVW(PJhUiJ=gSm%QWoSojIhkdVb-Bx0HqUzD*E@r8bX#wNO31=4ti
zKzhEdMR}4P*CG-%S>~c{EFOoANAtf(&+p|}g(epkauExzuC2W-P5E)M8AYn?hH(F}
znfhIW&1#HC_f<2=E`IY*WelMEmG$8CAT3iclWaSC1vb8v(u*OmZ#Y-tLh!g*T~1jb
zRkUy~47jiX98D$Gt5;vLs17P4ts1~eK`CL-p%9=}T|0_*mKJfz+x=mqJWi!JZa^A!
zy!56o6M+UhcI%Un;rLsaFf-S0#8@q@xpd+?mKzIF<169PFn)RY5QS=r*Znd-8nKStCUff{w1Tn??6fmLg&AUj+plv2|l
zP3XS<#H+T8=g;+tJ2KJfdV8K&u7LM_`^MWjHnFdZqvMtadKH(iNytMyoR;Z;`-X{`wO5GZIVwWQ8p^d*@fV-e7P^*@(hz+UeZBZia?H_yXL
zaqY672c@@$5Sj#MulrQzKe>i)p4UvYR+1ga7V};RdDORevhDL$EmFRzAm4UY8U{)`
zCsI1%d@Xh{ROWUN(14qG?t=@mtGn<@fb}OU&FlQGR0>~-fHv=CK2BbBM$Fu={h7ZU
zJ^h|vZ!Zs*MsJd2MVKn2Z=#~IVv!I3ta+`aiN*&jL6n+|bz4w+Q?TB!wX`l7HW9*Z
z(wn*U4w~}9)Ip5Bl`gdULSXFZ*S*18jGFS5@jfT
z!jYeb~k2u1flVQeX!|m^vPTT(>8SdD9y*tRuBOvCh{u!#WC_7m)zZiLR
z#Q+rVl7k(~o<-nsYL4f+sLPEp_4BzkIF#@+D>~L?&$e`Cn+Sfg#Qk-?@_Dj4`FXPX
zu-z3$iX3*pgSt;vD#1bWHo9pcD
zv!4ZCK*xu-I)v*QhF%ch80mAbe)Wt&GL?`TMKsWtE&E=C&n<=8un~yEKUy(Z1m_NK
zmY-lmsz@%QtB%#7sYo?3$M727;@sinKx+*c-@v8HBvd_NSbeSpivE7Vn1uM?c>*FTyM|m)FFl+y0WHFjHQl5
zC4sj8dI~~Er5t@wY3s3a(OZ(1RIRoMNp+G_P}{n?v@n!n9JVYz3CmU%7%PfEF#2&H
zj$ly6!l?5-i&_eT?uQ^Vpgn*h{RqYV5j=s_1+rlw+N>qdNF0kS1z1&3gh)~q!izej
z!>Ne9ZiQt=5Cl0!mxf*OEgLna-ssrpZ4?JGW!I;nY1zNN+y7$AO6i|i0Ef%XcL6kB
zLBaQCq4z6np^vBEzrRP7csNOJC5^NEu*C{+5dqF2p15upQz$JCO_6qJif%GKyatn-
zT|!1uxmWY!o)@~pTwBW}NiJjdaZxNc1Y4f;#{^sdu3jGpcjWREnGJB5BqOUByW>{T
zn6ksd!{p3JFK^dEFR9(JrIH#K>1WoxJ5HuZ?Z6tXAeXG-pxFF?Mdl%$PC-d3&X%G;
zRaqp%U{X76+)nG8SP{v7z%Esj|JnQ#8R?$#BrQ6FN9Xky#(g3dT`u6cG4IH~Y$mF<
zH3JH30Sp^DcT7m-T
zDnG_5GBy=em$NySBbfsxIM0G`T*OP4_lJZKRbj3fMvZ`C|!+TZWzS
zy=|ZJ2+sse?4q8ub1X%`tb>J1guprriea~Q=goP0T=$zBe{2W`-7PUtUi)dw<{6OS
z>!)>_6@p^_DrDcV09S)u{;jC^7=A_v%0nwB9nO?b!6;M#N+-FTAuT~m42{}(?wY&U
zm?-t?69SOv;JM$+K&GC~!w-5B6Bq_j6qwNwHtum6*7FVfAc&|nUJdXn&w?=dXM7Cy
zZDzB|S8UcOoNYB~F3jtaWg`0SB@ZqRAtG3KTsW1{=|@z9DH_L}R{{airtf}EQ|6j`3aP?k=-2iy_q=;eYh^x&;89L2
zW?xiuo0-{o)G%X&!8b#8{f=})O_f|*c3j73zgno9-$p}*UTPzzA3q_g!B
zhZZMR@yJnXuxREf>+rqT*{ntFvVkv
z*F|DYq*7ID&+$kIoSgwlRGk;JEJe04cK7W&7)il&NQ}#lQJh75$?4DpRH&PHRqqpeG@+
z#$$(=OJ`|v
z4Q23-f|b&(5x3+Ijy^Q407uvIKS0q$KcIQKNkRL=g(t7a+Sz(m0qdL@T--Pd9Sy@VPXS)U7RZ^
z9gHkkCZb&OR*_etp147!u~^A(;;1z=PR2ZKmoQ6P8SOF&_maU&>G-aAX8YTMt$sjj
zRf*WA%OY+{iv6>-wa)_=rV_`}$PwMi(X0TnHyMZ>%FNjm29akSxyI`%8t|}j1`BSA
zVN}`9`I6hoB8ksM&V&bdWLy{()p*lKAMU{=cc{*^7i9Q^_XK=1HuiLHH%X9&`q9kg
z3cQ~^esy;_u8CtjJf+oe@lSw1U0BS<-q#yrT353EWFXWljz|2KXMqHPjFuC*M?hfU
zk9UQ-yR)FD-gm*YW4-9weR9jDXOs}v7F9PGsOUR<%kg94+C=9Q4&kn$@PW$%Ep@#B
z9*SM;ZMe~%FJxp!28+g{uz7lLuC%C+1KV-lr#66HwOHR>%vlQheQ>7WVt;iyTB%pO{Ny_#bRM
zkp}C|N#(cho{yiO9}hi}u`WszwM0W1NT&8QQd0br{Y9##bjn}ZP=)V5j%LgFR#qzB
z+tA_kSU9wjCcoQbkNZL4hSE%#47Mf@a0MqKu0X&pTy>}HVmb#g;%46IIxz`l9z_oO
z00j`-MYI@tyP#G>Y1u)08J*%83t5rlOHO}8ci@I8S#C2a)=)hxng|Dwp{6wYO$@Rx
z?v28c$`kKNG)l2sT1HvL(g6{ktl2(Tm{R5xAZufl%z@sTYHJ8_5Tt{cVUUfIuEnEI
zYZudHxn7E}f|otv$%hbMkKA}Naebo8rGzPKM*E~F*x*&VaB~HG?@x~!YEOt(yFWH3
zg1bM@yWZ_TUi{lT+FrN60R*29i>3tMY>YtnJ;v-sSn(RRiu^LmQgmvPyV_z6atXRdct6|G;S7G%$uEQ82%#tYOyV{m$trrJFwV{HA~cJIzTki0Mp9
zG0zpCi1v9PjUXbD?IaDX(9W}}?H~kSV~wlE4qa$TkBi7i+MTOIvG_JyLT`82mMaxz
z$fy@5paljKKxkSt5B=VscZvpo)+j_P7oDS*Bhw
zvl4OjFwT>?+b<=PU0}T!^*~SV&d&|CPaFv^FCQO#4wh6E8$PhW>Z@4QF@~i==55Vg
zJvg;}c?-md()_WhH^+#D7^=y^6<5wYLCY#m$)F&JO`|C&$%&|oDN;{TM2Ob4qVKN|
zcDmm1bmvLEBUDuR3Ien`IU{YvQV1{|kTtER8!>vZq+V>vU=<#tUD0Z2C)eadb<_Rp
z=jU&6LS0>Lg}D6s1fm)W>rmsFTx^`GgqE$EI!H^#&=;OJzivkav_V0fhOVE@Ny1&S
zp!q;P7QJN-VZ*pKc5Isi=v3EMkNbdc_n(Uc`Hcq(){>@QPm^PuiHBesgt^e1&42Vf
zDg=<%A?|onip+eAVKQJjj6*nj)@dRSbKKW`pVyL3vhb0$`n11PC5BuYYx5i7Jt#*`
zE*k8NAI&Rz!4H@qTt28*`_c=U`S~j#49s+v&k1Yao6b&?QcHzwLI$h&`S2$MOKA{8
zV-a*8;dWraAs11$8L~Tn+e~n{o!;wCzhF|4tgC4mp$xJ4@pM|bnwG2mUTSGHf^`eG`Mhc*N
z4<(Hkxdh9~fSKRFrf+O%T{B(|4@uQ(w{PkFG0R@N58l-%NW}yLn3g^co{~v|bU^Mz
zMzZ$!@%!ou-@a?GWIt6qBlde_hiBFI%|0d}>nQY(AHOIMw6(l9S
z0LCM14lLj-H8r9MRS8RFYXyyxd6d405gbO%Y1|Et-E91p_8Puk!?fHwUm9bZy+X(j
zAV1$x@`u*gjNoknlSn;fLE67^c8ORfC}r7$H)P?MJIvaa0f&;!aVxLNDI}y~EHNXA
z9YK^Rmyl49kN@=f{Qd1Oq?yp$x4ic~g^%m!{rwf8x1+S~_xbL(tqr?{6Dja##f#-g
zW!Wf#8|>$YJKd6nhB(I{4TUeA`Kh-+TcKQ%968~QcsD(Cfl~%Dhgj%Xi4(T^fp~sp
zvoN@;U*@LBPoy4mzvdFXb|M;yXbuVt9FN7zYy-huG8Y86^Q~VmqWD?ZU!1S6=k~;bD1Mid+6#vV%E1B|>!S&6DTA~WHivLhqY_h6
zsuHWh70Q8oxJqQQvO2g`Q#~}%M3sSP0{yyQZCaeAlxLJte#eL3+%y#J91Mp`9AF<1
z#MB@z5;k$Bgc~Xg8lkCMMXiz|;3ZYxxNQ{3SLU98Q?sSuu@zaMRN!p@Rj)TGtUPq)
zNW@_!t@l)QO!>Y$ytQ1T-bLkveww5U%VE4j$zB{OD@!ot&=op_Wh=_NXIc
z8}=bF9xm?Q)6-)Af`f$!(LmI~d4W-#N&tWJ_L*WYkxQ$Hae4#%)ks0UU{+-puWX{>y
znfA-LlA#SD8q=+^_!eVBJsI=9q6iK^v?V#*+LY3EJrz~l5`cuI5-xADUD@-+ku_wD
zGH_16ze{M<^-;~TQ9B5M>LkEy9oj@ak4hdwUB=^>rXh{|kh+Z6eraK<0g9FXF*j5z
z_FJ{KvV>#fL3G{CUagGY!|753Pg_x9l6;Ye499GXhMwA2gRMbr8g}B7Ek;j5t*8h=
z0Ol&)S}<)~gyEpn?^syKvv!u2D8-lSQ%GU4oSdAs&&_ae@0G(C_;9uC)S7(p*xPCo
ztKzbP_=R0bUfE&igl=gidv-J)dvy1mszwuKN!CkXlape^^A)zLEQA*LhuPz^!6B4k
z2&wWVY0oMhJy3N$Z3IZsN5-(@EU&IWD=SGT6nI0Dx9b_f-}}=kq_3FLm%IPZ1-y5K
z2`q~Sw;VdCsfgY0dO8nf+l;SGLt4kl39v2l1gc0U8`xY(@He(W0rzwk;5X)o8X6%e
zB%y)FyT{*q4~;p9Yo;!0%hCEBCT^G!K4E*Gg|@`|;iB8I{$m~4|FNIg_j2RI+wXPv
z>ca13W#jdD@e@$|_(Ng`M-KjLP~}rJ9@NrsATE_hKNL;Y<37|MMP{rFl@9n-i-*)q
z02QZ?Iw}sUG>$W!lJ|6!y;r4!BWFr=HSP*O;SZML*q5$$EowvBE+s?(78RDwnm!`}
zxO`xylYGff%S=FMOxH;`sSI|pa4CA_ST9L&&G8-Mvk{Y1q2KfTaSYc+ayA=mzvsk|0`p$lmGIGOJ>%M|~bss7+vtOc!w%j_ubB^O{FBbdT@Z-YF{{oJimzDWp
zR$Qxw*VZ;&MiCXkIDOq-7oe%P7iZ4wmBm9F{r;}0b0#Fj_wt&gaLqhU{uBJb*0wj^
zS!CWaeeVedI^SgH~`fxP$zD6M++;POdt!Z(&%HWKZnm<`pg|*~rV05g
z!@zE=29^>QM#bLM*$9#ZmHjo^7#uTInAolu2b(*}aCLr=4LT~@#l^*9pE)|$F;=)P
zYubJ=k1&NH7lp2z&FH}^T|5c6CZuUk^c5RIJ3odxIS^2x;()}R}=<~sNO9Q2GC#$%BRIu-C7j(=i0UMq!-E0XeB&DBF&<9@k3dL~3mBJqDdKFKm9WDU+l
zzzLrD$@4DSSS;lsG#sb5_}9Lopq6<)>2HS=gVItG&>WIt;X~JU63Aa;Wb_GYQnOzZ
z+jv*fweXz;0pa#AziW5Tl0y!a>%i3db47`}L8fQXrsFyoY>Z)5%+9p-?!;6^C>>zmu}iO$&b6gfdI!F~cLQD1g+_Pz~c60D*ne
za#Vzut?AG<)mu7lbE2H1dZ&oRA^-=|huH;{Jp3_)K2pC!P>oQ=^tpR$|MB%>vsd_7
zg=qKk@DjQE;|<_<^=-C+ElhTS!kRoO6#ZLaPfX(4KjestrIZL8Ot9pJ)nMgr*^Fm6~kz2bm-+
zy*N3EW}=^BZ8f=toVz|Lyzy#{SW*lP7_Oewb
z`;xikgv4ExkmRWCgf{n~9i{C%@38iCiIIO84$%@PsJ5w@xJe$TOU-B_#}03+kXt^V
zlv^$HhFUMIR70jj8BRUQauD<@aYjtwL^QfipV42_U3>XDd%4|zeuwmX>-VEEYcRh_
z7RLdRI7y!6GksKQZWsuf3hFUM-LF7x{ZTUvPyT#S6Yly5PRgm5gVi26FFN_U?C%HX
zZ!enfvMD8a2m($CT{1%N8}A|^k5{8dpP1k%YbFHP-lX}6R>ed`x~SwJ`G97R{g+5s
zrhPRLsFtXk*T=`IDZ!P?Jq>+Wz?>`$n{X7F+;$_7$mZ~OKWYsrZ}`BJjuZHj9stA`
z-V~orVLS=a!Yt%_v?2uZ&#JnUw
zwFLp7%)H*ehh_;SU8fiw+XU-P6HL{modY4kh8W&We&xw{VdI)+2nc0H*8emvBDf7n
zE(2`VW2K$7>*Bw7KBd=n_KcfbWlqdc8EI+hR;2s0;B~dLiJEy-II~umP|gX~nFmM=%pM
zv^3^tU`a<$40~COd&jMxG^>B?TzvSQ9TTZWQo2ORe^t{OXG+_`kOUZv5CyuXK2YCj
z19N>I2)md}h2g4XH}h84(8P7hxJ7qfF$?7_HaC0GPzebLR@>bbJVWnkIK$1b%1Z!w
zv9=4{6%V=lV(A2YG73NT^t**gNUW~e$3T>ByGA?)2E}~q7&z{JLI64JNXd&|>{r&F
z!kjYR^_>)GN5+FD%M7(5%JL4_sDprItrmE*2y;3rWmm5vI8)qqak%;Dce;*0(KA4+
zL4hhm-ePjtRFW)7I+4ke%M>amwc{94!CU!+K3It)oixuq*0352V58c7>Zh`blIPp=
zu9KpknMRUDQOB~>WM*CNAM2km*Y|h7MR&5#UGeMTIHC7TgO9tV*?#dh(uD63bGwH0
z_z~GXEcFmSsE(}Q`~7Gbl&k%iVey_0Bh*uz@zO155vhXMFFE1Hxx83s(`D1x5i&H}
zC*Och%V}wTBdh&X;GK5
zznupwK^D4@{D~7vL;c~9|KV2A(AYOXW;tTXfEd`%88nB1Gn5BM#X@2Un-nXGb9VOTD4g0
z6}rH+Xl{NW@%bdqC0t+C9i|u2D>!DMau}mo*cgmc2i>HYZ$EYBi>bj6>pB_XaO8gk
zke63csS?zupf8Ye!XFdy3~+4P8F}+1{=^Vj?`$_OEb5Kprq4}&q!xODFH{DN5m{&+
zDCfGY_i}QB-{_(7>ek;;RO(f|@_LX?>#OAUi-twc6L{Gl1AOlq_ny+#^C2)<
z$lAp?`OVZ5-i8<+zD|x5y&BJRpNf0=`Up!UPd&z&d4m!f;`uO{Q&UrujJDU&la*#F
z&+Y_=fXK@w)bAmEZifTL-x@F4ad)}quA!qN7(ai^IrIDw65lCj0*m;$sQvsrh@~kB
ziH^$LegY}_h5RusXz
zLw6I!`bSd3LeT&H_3$u4cMcA5SY9ust)fUNY0M-oo7_{}>cHP@|G+^MS%0aQU
zaAZ3Il-ji&-sALSXB7gqK>nK388O;QUO2I~bOhks#ZV>$uLSS}lq7t7OK?-AmCfvT
zNDWmXnfn4`&yY@0*P@oAAn77KCp)iXLWb+#oE>2;*l8uY=ax`zR-34@?66O=skKF8
z{Hkex8^A)dWIbI98cD^MwpH#pA)eAvTIloKq>S@|yOAY9msKGPi)7deb~g!mAnj`6
zH}ce$9P33$VpgYV*5!S1{@#mke|izuJt8R7{ug4^?`kXD!2hmEQD&#fhL(01W)V|1
zr)Ylsx)^QRi#O{*G*P}JgW;#LtCF5f$oFG=?k3Vo&z5Lq>Ee64q3_|=dTvA!KntHD
zl3Ko)0ZDem6Vki%0(2@gEGm`hqiz>jiPnKyW~CL}FhQ0FLR3vV3f021{|^#D?Y}JcbJ*E*Z6^d2Ip|y{Q-aiL@IO!>RDj#930#Hdv
zT=~}tI(37SEPH3K4m-&
zb3XfwO+PWe9rFvE#Ze(0RjFSK{7{dl!q2FUnI7!#<9jykq{g3(<1;56SbWNId13Oa
z32rBFhk!%8m7O`1faZ9<}PB}Cj<
z<@q;5`h8TmI#-yv7Oq+0dW!vi;K=jd-rmE94$?!Gudn~~%{LTQF3-rWIB~hiaMLxXK%`~ygCJB8?(FQm_4eCw
zT{&P0^Tl&}6{hyhTq>m^nt&BVKZ6;^rkuB!6Eo>@^@=m;@>?MikyE1b6K)csot$^N
zsdV}(OHL{uMJ_iwVbgOQC8bDYzuzMbX>2iSaT~L0l9fiG%yjaj^pOS@jIW(#vZF;Bx87<+;S)#=4vll+btaaa
zx;(yQVL}(4)c>kPs2AhvBAc
z2XT0S_Aw8`_&UMTKTRBwDrl#_#gnl>J#&M|_qxZHQG{)5ndt7F
zJL9qMo+Z;`F1o(^;Kx51Zr1$d^z8KH1V4&*xxV;li+bj=P!$grPgA(FX^1=0%u$WJJy
z|JZfi&hGANwMr?CCp(kFHaFIA;y$058g%S=>xVz=^iM%Y
zunwlYZy~vm#EUhNC*OUyUaxNjoFc%B=4$n`>kY@a(J#}&?DO}KYc80VMC3UKBcfL{
z;O*_tUJYFd&-C9yZnO0Cg0^+`S;ikVvMpvFvA_Y)w;^vs2NBxj#fe<(9s&9s^pa~<
zat_sMYwPabUhu5Jvu85$KzA;_g&~*9J^{BVVGD10a^X^Y>)lPTVJGgX@Vq1J^ani~
zeo$&d-M3q}VZMbTm>^$IYYj`4h18GI{E5t=Sp`%STW#h?)1FmwDzcC!+Y%bx<$^iV
zWVrm*Ecx5-ytA{j^NSBZ{L?qzgxt=y0=lqW3E5cQL~)V54p+xnfLerzM85dqi@9wc
zGO(~Sxiyl`?H^p6w8=zjn&@6MQce=WGuBdlVs$!e7r1AxkVTGju{P=zy;*vMNMFp*9P*v
zyL%7z58l|{@3&S-=z6{W_VMH2{_>Z<`Q7hs)@x(#>i;7Nrp6TtNSL74{@s#pU}IEc
zXq~1C4UCU8w87QdVMz
zvl@VLZEIL>r4=XlvJ=q2*sg{lcb)FD+2=YauZMNl)p?}B#sx~4h)L48wJzFFrZb0)
zpu(%li`}auQ8^R2`bG^nV{tT*B;vQ+^8u+0nA}q6NxGjv?KX}r0*gU
ztGhA*>kyonLW;u%V;Dn*;4kLlD;QJjC!*`i%agOyqobqa{Na9&d#ZNjS9*
z{LcIDhmag`;-~hlMt`BkL?ZO;@Y(ocfn`Xay}c!3wr^@L%G5Y~Vdw_pirtWXPub^N
zPs}JQHT)NXe1GjftQ2}dGfNaV$U)Cz7D}~(%@sbIwCqd*dIA5qCz?(Oy)_3tR{^cr
z3CpJpI}G4$^u7D{`@UzMT_k5qp(m%D?qXhb?g);0fuXzJ;^?_G!QHu5w-X!{*e>h~
zm00u0=eAV~opS)BPg?LI7?wQ41~XG|{D{F8ETE3RaP1?a0sKFF=cIt)jH<(<)x1s&
zHgk8A(>%-?5yFRTu&zWN0Wx6t;DZl{`DZ`-`<#d7sHPY;V%t|NqI<_%BOzj?$=c?A
zAn4N^Ex{`C`Ildgv)AXgsOYv*Hj1hoin|VXEZ(1Mr!lb+rwKbU&-{ZQ{9t?=q36vo
zX+E~YpoOTul!+r|B84;#MOGqxc_U&dqfPu3Hgc9zy=h4zcN16DU5*vdg>DnPphj$7
zQlk?SEpeb%eyF;Y`Js=N)THDL{)$TpVgN|W5BGW8&b6BH!jSP{|3b<#=*hX)+!0z4EgD^r@#H}Z-4o#UtOMG
zOh&2J@o~Idb9rr@%8w&CC#G_7ums9g6E{Mj8M2mQP-)FSBJv=InX%5?tWJaz033Nz1G+q{NP0@#nRkswYm~?(Pr}2_
zFmSl>@Hi34IS*Yo$|nYbS}#*(Aue?dNs~7@UrVfV5j{piPp%W;{{H^<))on|NRrIs
z#N|YZ(f2F~5ZJ^Yf44q8!pwDbkLry{)ZrdgmtoyBPO&NMAkpHeSf}k&jhwvzztePvkJJSQIEaWGe9;^Hw^I-%OBLG`RL^*}HQGU;Er#OH*&(>_9E4
z?>?vr=+klrbX&>D3g6tqu}d=?&-LIy(%Li;3t>2VAt4tDakh+Y$oZ>JKRrD;iHN_p
zW_Z4}g|TLHS{{Q@qlpZG5j8wHm5S56pQv+pNkh&B*121rZNn8go-07VwY9Ue)2~)c
zRA0*JmEbuH^+t=3UT+~wp<~R6Nf8^~G&IllvVgUvu6z3jKR|x!U95mMK7d>qDg4J5
zYSUPu=O@q4&dz4RqGYf)R+ypo1DB~R+@I+WL?6qaUsuNY))ez{!+pXcqL;Jb#_d1d
zi5xFUQR<%vZK?+^L$TT{TjQ@wgFNyr42wwi-tG_NnpVmJ8FK@B!CNxgEknRW5BB$+
zhtCkGXw7$@A`R=9vk(|fUXtBMe-IGvq83PmQJ2Y9IQljhAq~vJ8P`_AR%@ZrYe-o5(|4)$va@thhFqsm~89;IJ4NMJZ}RwJt4C#4rzl^>&=KYNmM=IO0&qht4y_jr2IUnaU5fBOQ)!pC)3Vz%H37&@|sXB}ffNpY0x
zB_~ce+y~a`19RKTrU9)D>pVg-rkR+CnTad@mfhn@)>1bG(Nb8FvJBaZX{Z9Oz|}Nn
zNHs?l#G7G41#Ve!V&;WVUJ$BHPhG7!=7!XJ6wyvv=Th*i7j_xd6-$XuY*igfRk6?@
z`N}M{_p?(^AA5fJ${ZU
zUDERrRng`JFj^Ikip8Y@RbdxDpo;|gg3bS`c?4@o33r>@h5(&1*3Z-(Kf4_^q4
z31(Cx(J-u2%FOj7I0*(yrI=)zi$---s;rNmXyz`i!qtU}pHvsx+1YvU;DKZz@Yrg{
zF6Sh|V+>7ceDP}4ny+y-Od4M^x7CxdnbnhY529-Q1zXa>ViMCY8Eq_RsVT4mYn_~5
zo}Zqa9v&Y(KRT|@3J71~2OrVb%$%!CU`4jM@Mj@-{;LQRN{!7qyJi5KVQM*V@$@}E
z^faW77015%*oT>Vfu+ret@32p_Ffb!HV`MW0!7N%yLYd>x70hWx1Gk8`tE}t{g|2g
z$?4h2$%*%V&yetJ6?*8b<~nwT8NHLY!3;Tcvf961ufO=@lZ*3nda0(({W=?($7^Hr
zW;EliM$Q!$ZiRs_oC*H!9D5;HI6wW$8p3;kl+w=b?)W;vnsg?O%?$Js&CxPUE{N}PxoZd!QNLO}eDsJSZFe*8jG}o3hH||`D{Ix|k^a2`kxB~t&}6{o
zTz!*SwsEp}BQU1;_h>KCUM2e+netX_-%s$nRU4M<>t$ns`b!cDhfRlXOvi5Ajy*vI
znclD8&TyE6ws^)L$lmrkLF9BP2VL-Nt+wvmxwCLA;1b_RRCP&m2@#4y-10^xy!P0Z
zm$o?=(>x~&0SBoVFtfP$1+j`?7Hig-YeUPkTJeYFtEL&zaHGXqs~%6~_STb9{7N(j
zW6T=e5AW>lef{;uIa_;v2=r#_wdaw%_vpQT)sr`k=GicY
zv&<_en0-2P+K+GK(}wdq%uv9w>ss;!9KJDv?MmJ%Zy3u&S6L`AB3IrbfH0aJ*k5Om
znSh={aX9OcPIAYPaM$vNl2#`Vs_#KTwQyK;?!L~iRNm&oL^LJ=L}z0?|79%FC9-wL
z6F+r01H<2k)xV1Rhxqv{Jxo$R<2}JZ3u(=SZqTXwjdcFdh
zh?qp=l2~d%CBy+ge=xCbDmTSRE@jpy$^)f4ckb-Jad2?3zrD3RB0M=c`}EUKKK%L5
zpFDXYB33O`=iz*&A`2K}T04p?0?HIp**ete%>!c^kR#ze->hjQcsT&3sNqs+G0j-c$4)hdMQAP)UF<$t(>w_v0IeQN)OFpPZ@ncs85Mc13|Lo>;26(Q~9jr+K94C(P93S`H+1>kA1bXPba-qk;XI8{s>S@87@QbsgV!
zxW@uli<~Hf*4;vF;mHhU@iNCs_@#$tZW)ABu$joidhFabi)K2*AvEv9J`S5s&%7DC
zK;_mgM;%_%D4vj%jJDU6$CgThc=_GYREU}{{Bw&A6OjX+mCngRi<_m&$-*KymOt12
zAHM&7O6i~fu!f&lsj~+cj6JvZ(6Gs=u8jGWfWCnnRlC&}?FZd>H(tMr{
zRzi#18*>+h`^zl3E4v--!~VB67zVu_P$<@SDYBh!LexoKaq_e?I-RUr$t1I_jT%C>2ybwVBn5F!wk?
z_o&6oyo9Y_Nb4b!2q)>%*wxA;3%6_zJuhHHG;nI#t*K`SuxS`_nnDJAQDXC1x6-Zl
zjl#^}n?yw0d7!TA2Voj`tblIf&Mh@GOSc+7EZYd|dw82zgCW1Vj3K>+7ql&p-b7=K4Bf_61rf?CZsYI>#QFv7#BZa5n@%S^~hN?PBmV
z*p6VVpG)4p#J;Y1|6ko3b4L~CJ
z1)Y%VF{mg~m+>wi-wiWNR9`>nv9U($4N8%&UarmMd{?X0qeqXv{r1~iCe90{jM0J%
z)HiSQ7=)Bsym{M=F~YwpD=*T*;~MM#e)5*~y22r%)Y98!z%L7NGsk={D|7L9iA^ak
zpdPhFVpeDtM8w}Ay!syxQ#5<3}C7!g-!+wLoZzRkR)ZuV*^X%C(g1wDF;@!2W
zg)M*;ob(qwZ32tg9XwLYby3dh9%%jRo162q^E-QY%+gSuWbDZh#>QL3I%nk6MMn8K
zZ!`NB!5bx1aTu@|(_H18IbjbICCSrj0#s{-FXr*5ps6zv-t?hAB-g(X+>H`)o#W*O
zYiFqFOlj(LyAYo2Sd*JV#KAioNh4$^xfSL_oXb>7B9y1E^^%ySEFAC{Nx8H%CP!sX
zt^!X)nQb^yamH2X*S`~tu5q4xKxfz)^S0GFOFp#u6%b11M2i}Zs+KTi21dbp3A|z#*XQs>Zi?1&({`B?NySuyl
z2mAX62RnCm|MIW?>aYItudc6e{`Ae)zxw5`{_t=AHVi|{lE}25P)3nv8ZA&f1*9lb
zAduU>%Q;(VcC^=9nU7}Z4UzsV@R=0hwh4sYlM%AujiOY{>RCjKv*fxhOR|msfyKR
z$?GlSjZqXuY$EO@glak&s@#Yn4gW((&l!^E`H~`vIz3LbI-XW`aen^AC!dT**BK`N
z^Ea=5?DvqHeT^Npngd#8VkDZ}E7!u3kcqBV}dk@}x)8CSE1P5uU=WPAbZIk4$5Iz3(+njTF
zcL9UH;XV8nv(L8nE4O-SGR
z-o6cR1T9G>W~#ezv)Q5OXbX{UV{e>cTWGlsy4(`?N=&mIjBh~OTCH~Lu^YFY>9Kr+
zN`zMx>=A|i%{3xCWlSm4~!$K#+
z-*D?S?Gs93%N&G4WzS|rM&|d`lkD^c7{3nrL#vtA~j0@i4}+%R2|(Z{Bh_
zvOT4Tm~%N0AQQcDaB%Pb{qwW4fBeUPlmg~C4_AL=(eJD_a)3g{jH+Pf^?Kti5&Ghb
z&;3jxU6+ctkg<%lAO*kYZF$>PkuS*TeVa66M8wRG9z9z1z28mw$wg$%YH-%MKYbKp
zkrl~`Q?Bn=Gshj^*~hSkg@R|1(+1m^*_ONuk29I*B4;sg{z07Z%Voe9sh_;H_Ca$!%n8!kh%h#m_mW`eVRK?nauk*ShwIq?zL790xMZ4xerM}1ua?^3R
z)~56WNh2g2E<{+|3P?tdpqceQab3V3f#u(m2}p4_aW
z$~j-9WYpy?QkhX16VQX1ewBfg^SVo1dC+C5!nC`yGiIXi?Cy^E^Ud)1yC=W-&2N75
z>tA1AU87>K%&>}s7BN()T;mDO93ALfRaXsEwKUm1XOf(mbLvo1oCP>sy{oqHoOybn
zfEnTGkDe*a%)*=n&$}?A@V6+oKDyq5U(jI%^j03I>v$M?;?yNgoE9peiAW@0l1Mqd
zN1XiTJPj(JN}$WbFbrKs)HcRr0$N0n$>~l56O!DOZKvRi{#;<(+SxwX-B}4R%M>E{VcB6LI>hdcxyN_9u(*e)Yb^d94JPeW2Ar;+rH|tg38(9b@
zY2X!_ieJ7{U5J@Trl)|W7Mo^dp@KmiW&{pJp3_^kMMW~+y>oX@#X0Ty^<}e071&8c
zUEh81wOF+-@*BE8?g&KaT##@D}c*rsycCQv>4Q4Q(o}7I7>8CYmWkQKT@?WSK
zZbQ|D{dfy)Q9oj*I50#T249XodY*Z)$4|xab%Lwaiey|%tP~-ib1Zqz7aW6}GJTj>
zXdWO8G|R)ix(tWp0B*&P1Ml3sckkf9>yU{$qG3^xS8Oko`4y3;PoLi0+`K4;FbXXk
zB>h6|b_T|mzF8=)WSxBlfdYJMe$@-jf%!555_j+3J$T~{4^IVt3<#}&RP*Cw&eWe}MbgzQFkq`L;a`D>QYbAE
z5z}eT11Hih#6)*#S|BR&%bbZ5>9i@~84KDXD1w=`pbUFqHKu_LhOL|>rKD*!Jf+v>
z?BIY1Gla@O2Iuj-GKgRGsgi)uN$8U@76MWtCOnH4xUF5r;ThOQ0aXHm;U^uKTsE?6
znQGn>=NcE`Rl*v8k@L`jDz`0gcp(cBCJUK7t2_!thKxfQVvQN*BNhj1;
zVaVY3Ip3ry0j-MS(ey+lw6(K+aIk-HaB%0&oe^Zna&&n3```cmqhEY@c6M&~Q3kE7
z6t|nUEdKAuh$(>>N^7XVjlmYO|A7X+`y|5MKG?2-42TSe=2q!
zh8rRoAAbCQ#JziyB)5?#_;W;NWxczK50T@;@hx^YyQ;b#-BpzVzdsNF`~gH}bvHGju{r|b@E05oq=yH<1r1A9b0j-QoH^rQ
z4u~X%O!a<*5W+h@_yMm+0?Aa+%8s)N$WiH~t@fbbe?UQIfVx=+2TEc3VqKmM>64`y
zlVi03shRh4!8oq3Zf-8mFP>eT-@bUE<+Fm55IhP1qd;l-MQXSd??TJ&XQ^L7RfJln
zq**c=g9fM0lqVUURJ2~N77HVV@s`Szvlt=gEbG2jWPIGe`gtv>LBit2b8`nmrBBTy
zYhas(D88YI!13XsWSPYmGqNw5FEEPpUkt;CKmB>+sP=%i(D|08h0&xfGwz!5_g`F=_+c4ItNz5n^tzJXR=FqW+0^jQk
zcJekywP7ZNu)Dv%TrSITfrz&f>&ozZJk`{2!!0YdUeu0@V0=x`6Wf4RkQ8F
z&?Nx9^~}|_k+iBFeU5W_*t8k(K@&9?sJ9`6ehh|rK~lpM
zVrV8ZbL(S&&u4)&JJ?c751z64M~$V32(0uNo<~an=k(`P!Z7^kM?V7aKmNzRTwXq}
zV1~3%a`T)$&v4NL_iG^3>n&C;2`T{dH-G(WdEHB*F>9P=;iNEkm^ZXGuCf|yk5+1`
zDc-06y#N0DtDT)@&w4#1scocB^25A{yc_~tFirv+wWs#d#*7GS=Ih2!Y!LHtAcL?3
zpbJ{5(x&_Lo=T1>?mseZ&1fyR3ywPh`K%kT>+8C;uZKD&LYBWLc{FqRq
z($aM6HCMq?O<=qPk3`LJYV;ssWY%Of*@7ZFa^QHM54@@!$`iMBmJ}Q=cXv)tPESux
z_Yd|bKNk7<^XGs5@0BVuo`oiV-o6L|kI5F7>+o%LKUNYqSpRjLhzapbTlPgAAFphqbTl0;NJPk(n1K>)hwnd}H8PtSH&xJ8!=|P)OOx
z=maYv2c~fAHn^M{r(p%Ni;h0)vdWnD;mt4sF+|Ss=#VK@GIGSh4N^&QCK@Ym*X#SM
z>+6f>7iVYZcXziYm}nyMRva;$oA6RMY_F!<>MDhdigV-bwQkiIaLn5pGhZ7LS&(Vv
zIgYE8cV8BV+DJ?*=P%0jqqpALJ3NFVhr9)cuYb+*S}{}R>zkX)
z%gcvR%ygSlY|qVuIp@4X+YHVGXc^%iV`@Zv5Bo(oho^bcF^RT~ycUZl0G+QiPPPEs
zQSbZPndL#NR__HzX_`xMWQDcKwYriS(61ST2EZ|n4-G&=ES_31=+$a>Z*OLynRoJ-#UmG0&2!kABzmm-WA_YxXt~O`^RpXT`;GK8GsBgf
z`X!a#M9J4Rp50tub5<`*reS9lB(J$O
zIwodXdD9XVI`06aIDXv)VF0pT0xX8%gAYD1(@O0=odt=G4I~Z&$7Mcfu(w8HZ50NI
z?}Ai+8RJO7XgdG{$NdmwLl9oXh`cF>$C>WsU}4u;hGE~!Gg>8g4J6GdmJH85VeSc0-xW(3wi<5)Ae=8&
z<5x~q89qxRqRiH4Y6!!#Q4$P`VvS}iG6I1081IH4-BIb3APzS(I+O|8-b;u8^tcWK
zWIRiYR&RwaQuCeF&dJHi$;s)#(Lo8&U){X;>@R=$=%e3!{mnNVr@)o+qC&AM?b_@-
zOOPZiqGy{7qq=zGiEw0
zmuZI$BI2~ObBrFdzknv{c`yKmu0ev91@>$b&S(wMW{1LQqp3rGagw)Zm-MOaJIf!n*+*5E6b
zYQh~&w&v@N8)SFL*8ufTwGfiAc&{Afewop&4cfN$!AK+6HVL#dR?VR7Vgw#mw>of6|RpEOu?qJyEe`?S8w@Bi9Xd}~j@t&ToRL3Z+0{iKRP
zT$ANXmYL$e;|EAr`W38S$C}QP7foxFsAQ>+L}yXak2svI@Fq1@XjIIcF_cF|rP>~*
zN-2nb*+9|`8B7!d2|`TFU~oV{kWqeuiaaXEts~}EiKy09xUI4XZq4f@2;)h44kYw2
z0ZY+jN-s^#OVV*wkq?4Pli&$JCTJIK%Mbh^^I7mC4~L?(;z&z)R|d+ZmZtD`;?o7Y
zSp>Bw8Fh~oZ2-8tyLG4D7$iUgk8WPsF3)Sn)CPfwnHkJu>W4@yOhQ{0QYxy
zSJ&6)7Z(@L&erR?-6fU5o{5&OWb+eOK$Z~-9SR4uBVwt!35QH-M;_NKP?6MK>pGfZnjUiJTh@`NVPy{IP)pr4i?d%bAp=_
zcbN|0nvlNkAxR2hr=R_UeL0MpBU3(Az0b8twt0pRK&Quks*uE3BXXuypL$l1VVYta
zm&2|(NkYuueD&4Yci+jjuU1~O`GZJMr+$VdqkMEwNf^=;&1jb-sMQwwN0&dlQ=($M
zet;L2Xm@XKXSEtaNI_@T`#T%yOqt=c*K6jHH#tVbx|()wDoG$Dhq(ZdR*R9YVaz?>
z>MX&_W#D~LjD_HZEmFvV=J9VV-$#lrfZf&358ip_@zbYop7g8k4c#Eec4{tYw^5^8
z@F~;}VeMh1n%1jo@HOdbWUf29=;xDi-=N0YLxDIl1>!iJI@r>lSyFg38+B)}iq8^#
zQvwh|Am$Q-ZX7(QarviHL_LJ#qa&g%j5n(~oe;sq8(VCUIxXWGJCjrmrrO}1Ng#6T
zkWz0vKZ$GOw99pGhv=R}8||;Tj+FK6gp!r=kz~G!vq!X)-qgeHKr=I4N?Y`+4nwH4
zjV&y-@L3X{wuCgPwM7~En26bYjPJcGy$W&#y
zU-N{SY_G9ELcn*=o~?Fw7mI~a9ckSbcOk>&h;aunq37wTOU30}KmAERp(VCLJ>N&*
zHh(%}VSq)Lwv4T&PCyAyQ00~j6WQ2|OMzAq+;wm12&XH9fq{`|=`41NqnUhIzg73-
z?d`}a0f^eyGIN}=Nr)(3m`)kY!%h2_ib~|kQbv`dXds?aucjyI6gPkvYalQqC4doO
zn(r#M8lEPrSVonRG&6=jw1HN_5k7
z5rUcdN&LfwkV(=sf*|uOJ5I*z7(flOLvPuE(sw%Yo@BYZzkl-h$&)8fhUMbq@78~P{O!m8_HV!c{qOJZ*RpG*AXKzOpcpwuCW^xl(+u9v$*yj^^N}6lIP@?;sEbESZPp
zGA|Uz0U-=|Ta
zG-UA$Md}km&(eb_p0zJEezndcLKUg1zSfexDO6V^D$7oDc6YThfjq$n3J`r~lw94K
zR#AfRDowvl>lPf|dG;uo8t6(1(}X8?Ax~XLD?!HU9bo3KKl|+Y#f1TTBjx+RnTi>f
zq-(ZE((4*|?P)>l5aPPotp)(DZL@<)*;%c2cXx-yf@19P;9E77-(<3srcueZaPp#~
z1oWv(Y?5x1v3Wgj6xQJJPmS5kYf_Sa=l%DWc~?YZheP%t4=)7FM+9HJ6s(c?@weYL
z6!Oq*nnlZY{YDH;ik$#-lL6aPde601`JNn-q24W=KUZ^x-1HgK12O#z5;=^z(amyh
zSdcuRr^Tvweu&M~i9xN_18Hg|_;qcIk={MW;o)P3*{Hn%A`c{FZhreH3fbL5R;$(S
zuH1HGJKM{P-D&OAXjB(Aa~K>=v*(FwAq*)%1t9!O)0x@UEZ5XRs?Tt9ZPT=BGe`8+
zS_ZxV1h*xE0h27v^Sr?p5`Z8#Gwn8-Go!Wf(TsYV0MKiU(!W(*I_g?`wiS)_O72a;
z+bsM%yg4iT;NalxcisW;|NQs=o(?cD!uqwDw;b-sQlIv@Z7ef-L2AaAUw#pp4SO~N
zJ!6!clCyi>tnU>sg8%K>?Iy8J0o(zA(o_=U-v0i(@4O>fN*=F?BsC}IfqB{5?4op=
zjF2{0cW|_%-~e94cuQiF4RH}T9_EkLSEv0VrwRGD#VdoFw5lZD=h@O#c>`P?BfKN?qy75VKGR0{|2A)DtN%oEukt
z>QI!_qhU-wkndDfhdO2^BpI%zi|Om>DRKrh2@fxiBFu681c|IT6r=69>+B>?SjIn5Lv{6=H%pL
zvD~Scr=6l>wR}Aer++nTwFf1$^2JHE^NLJH2~9e@90l3Pr2-mrjlhP?3>X7PVkY43
z_T}aEi}Q=~i{}?{9L=m?Jad^Aixfo}1#@FYF#K!fNDPuFGA&5OqNAg4XC<9QxWC$*erKz$W
zLec*=Y9Zs-ZtN0;&X$zLe2c-yYJTP^=ndWHlM+0zPo7vFvm?=>d~EVp>Mae
zriW1!!DZWcOAHTVDG_~zHlpy9=oS3{C%sG8hGM0z4Yf}wGc6NgiarAmcXRWPRc!if^BBvGZT=1)C6eGeN9Qb@C>A+HpgTFFo!z!iif213oySiYM!dsWEeV~
z*=Ub^JXFJA)+U-xbH*
ze6X$DX2b-b3q3#Z{Q}Q0IpcriHFYjzS#qQtN%!VddS59`j*FIEQSn#E;Z$jds8LAM
zn}ujJ0f@|>6+sMdh7KEvr&6@w-CAUn#Pr-j-fk&(sNzj1j!Ez)NLSwSV-ABGxI
z2hdVoxs`?y%qtC{t^&DO3@0b2C#NTmj*bxWdlcsLXXk(X(;t8Ro8MeLe~vgZXbd5M
zOni_HT5Vmj)4g4hs9}I1j+jeNa`agTj%(bx8-Qje4#*+qW{L}eQkrvQ4giHvb_2?E
z^VSZTz>=pt&~!V*7y!xvXqk~s)6B?#+SpB&917;Uaa<3fKr(Y2BgY7U1`$X0J43TX
zs}3EE<9ZAO=Y=;{cm}ZAT|GK}6w8D1PfGb_4rwTuQP%V|#Q;)u?qBaG6^uY-@T+M~
z2M`5K>&Il)Fn|{?UtC{ZU7VkvU7V+l&S@Nn$VlJxh^;t{xyl+tx024|PQ{LMW0kPn
zqM}BvP@ru^LXA%O2J9z$s|uGgP`^2y5=FFaabdi4*5*}iyf_@e`+{yI;rV`Xtle$yIKvyz|n?;JUluKG;ObGKmNK`V|eiO*aD%q
z(w?#P5H?%&l;7*Y-q=A)lRdWI`_YdmgeGGPV4SnB7E7Bp9uP!ctK`q_h?$=~dvIq>1aN13Lx$K$g=+#pX|k1CHh|1Hx$mdc?{#N)NET@h
zxfSCymNHICDh;GqjlITB=%Q
z&Pw(eOt^{ho@|bD0Y5}NpH`a6ZHy(e&;O{FESXgz3nOd}D2P_R^cKMBb`hi8sKn%)
zN_#NE_FS|gp<=xF5Ll6qR5m79-y)?4VYW=~iPhxAJ*5EGS8SQ_kUBvyf$
zN)fU=^-fq0oN1mC+i`Haff_Od9eI(bEEeyF8gKy#n8+^!6(vYj*UoJkkQw8dtI22y
zs~muqW6)fSzNvT$20+Avv}2(xW{N~VIypHxIXQlGOhkbZ7$f2A^6HaMKl#mXe)HYq
zCzVf9NLboZrf7Ym(5ig>ki?BsoLRZoUgC4TE-~Nou^<7!5XVT1lHyDgfKW4onFG@IPwcHgP6HSkyAW4#yF15
z(^g0sZ9&MW(2@=V$cGaK0gn*q-FMz*ko<{I&ncWPrrN;b`yjCqbGd+d2~^mTJ^=z=
z8iU?SLfx7vm?{I%^)h(<^5xCt)%C^M+4GBw$ZUh2;x92HMoP!ngg}Anuyr36$X8Y}
zZ68hv3N(VLPydHnN?J#v%*7Qg{mMl{pADw5}q6e1~9Hy!$SKN#k{#L
zEJ<3*=Vb-X97yh`Gf!9AjB#=4iQlBoVAj3S7AJx2?d_$sB-Tf%v)(e>8#%Sq1t2Vj
z4}bbIAaB9pEndnz(ctOrpkz)8*5n?Uv)BRfMB&s_@Za6teg4TOcel4%9L0dY{Vyrp
zk`yhG*>z77PqQN>j5jHA7qWPMOk2;ke7aaJclY+D4-@jv{XINz40xMq0(g(?Id7I3
z#rDQqli?l%J#jpf8+o%Xuf>L;f|hWV=Q^pzqBA>kQeg
zkLjx==||wB8BufBs)a;IbKxr#v2`8A7(&<>RNV$C+IrwI0clY)h
zJL@UTTX5LIVDNOJQVzogJPjoClc}lq3qE#_dVaObyFeuqghMNk>Q@Lx1QHk|B#AZO
ze33Dljb&PE=?EihhEqz03pVm
z9BWa0b^`9?#BZ*yXU2Y9s)*}1Gp?8Dw
z5k$8d&I89C3UI-9ZrO&G06{^%zBGe1^-#FgFDEAB$(>lvqJ)-F$*W%^NJV)og`jS^
zg^Fd%F9X!1sl!r%W9DPBF%p|#q_)ygGgNaJwlllM0Lr5h^dzxyL{xZ%&RfH_sLOK&
z_lZ4=EjtLfWghhis?2(qYKq*dLgJyV%io7xoC4+Y|<2zCg
z>E{0?wngHzeC9TW&Lgs>A5&P5oC9Y9$#ncu2$Z(bAj&DuB}+qbDQ(zfH;cyc
z#m$T7S663eXV;gPWjC!TvR@}a-yhXG0nCVFV1z)F4${={#-urW7@1>Rg~(pfd)IC8J`WQmMSeFH099PNnxPY>3;vJ3>K_6;jbyco22|bet
z*CdTgn~>x@h;vh=?2@bMY2CL|MklGHW1M@=+vYes>XtOHSPVb@@MlC=5Rp-b{99T|
zo=PH&8A3)KQU(J9-3O$bOR&^)iQ?^x7oUIn>H5AN*4Zn(5n}6Nt>HEBG|QIAnvO`H%O62UG8dEXY{G+CUNipF7NIz{#
z+Hi2KYeUQXlqNqCkB3zLsMB|n;*4<`6-^q>%Qy*^kvzc6AG|;8D~=%
zY?mr#fCj?I#Z_qf0{-~;c$l*48fo34%N{Zry8ho5kL=$jVj@iObBjby5c4ZSKzVpS
zeKhFizs<}7-`1?Add|E_f_03~u(6^1M
z0aA}@JkB7`Be-c`3D51z+pDW9Xev!ZDpX31=@Amlm}0ERuK=eD5*UO~mEqhSRHT#L
zN){3&6iYBMc;$vJAh5T7qcElBrOwE=OK|n_RBNLe!a{ELBh`@`!
zZ8NZw#C2Us0F&*MO0F|ff06#;1xdp$alPiAEv)+83|^HY
zS_l+!WRWB*D!!;Z3OXb-r2~uRG8wj^#&Swwc61QoOX#hrWkM@5pF&rmbR6Z?8Uai+
zEiEJ`b%!sZ=PVaf{RYe@cgHLyWRj-tdg(*Nu*)`|$)&%_Ete6IF;m%EXVNf7Q0aQk
zzI2)zT=WN8{}W?*@J`_vVQmDVYHEm20`p`KsPFBR3)5pNfQcE5F@$vp0KYstdwO;j
zhT+lC@yY4wqmxGr+TY#(#V>yGi(mZW?(XjEZ@&56?|%E|KmB=(W0j~dmV}l1F#{)s
z&Ouy*$Rht)`>vW9twYcGLd31JjbRuh9wNk%i4YdUL}>b*Abv2^`&78nw^lver;A>
zPa%GuO65)Jydu|V>;`eZL5FOPjjG2f7lSw=4ANudPaYe%HiwT*bhQq}yf%=pTwWtg
zpCv-b+hsRP2;unXsL>tHi{;gMa~ct)E1+bI)!KZ%H2rCQBT&D!Y&B|5C}w_?OD;b(
z`wfw|iHb^Eq;KWK(Od}_-n>wy30x}(D$N*Jv{=8tzhAG{r6ar=3##_oCO0TB!NUk7
z(tu?^wnmFYlW`m$KYrX~ri!02$e?O*uH_Sy=J=8l$gv{_f?plU-|Z0Eo&Yk%=B%zP
zRv0vEq69qq?ztH?nAbgJFGvBFi@O+^0{YrpCd6)=g#@6s
zK>(0{<{9;PyES-H3F5*CXiTozJVTNf2M}Qqy;FhgAkMQQ-qYN>D&8kT6MZ+KvO)0TJU?%1Wh{#^nAy3*Uw=y3P
zG$kNQrIY4a+JEU68^L!TIn|ZDhHBVI!f@5k5??$ZVnsTEhW<2at3pPikZg&`atAD^6_o*X|4
zL)cmE{Pe>QfA-;r>v4Si`0;;y{PDm4`@i3aP-xk%nQh9170#%OQkNGM{rGTE(U(CI|rSl--|cVrYnQ0h;zT
zQYwb%rCLOaan3siBd01eV?WRfT^2O!F#o5{U&GmI@&6JMJoq$W^(fDrGQA^{>sdmRSQ^zo!v6)1p
zaU|vdAOs}45^l4G&bgw3c8PU%7Qy1_1!3+oW({8)oiHNpgrP7Z8+#t$&5OVJ8AeMP$
z?h6`gS%eRZ1@uo*ZCq+jR)Vkso36Pc4}s|M<<-^o6`Tf*Mtb!#kj*BBOHbDW0JwVo
z{L9ZiV|QN4-?F%A`W2D*8Q*B8F~+pj$}*3{jJlron)SnCvA4IkSS|xmN_IBz{;xsR
z9An5nuDV(cEX6^q(reGt>Zw9GK0VJxl%uQ{)N=uX8frr}&)dT3MREaMVoO_rzPT5i5Nx;K$
z`N0Pt0C@W3$^ZAi{#SDqXSd8NboEE#%~eyAnWpO0T1X1Z{Kc1FPKnzLpb=y8`mqZP
zk*vCLb>yXJ*iw8Ityo5I$U<68=HX+_hJ{{`v$-{C)~X{ptT={g
z;>nRe@xi;1uGoBGjD>FDd>vJhRvt0cZJ>?+v3BNc14Zqy
z+GD~Zj`v{*T;CbU*mOmoMPu17?pqcHh8SZy@FrQT>|AkZp?@nzKnUUR=;*DJ)02~v
zFoY7{Veog~J^Ro9{KH2deROku18GaBY1+adsU8(sGfAeq%y3R?Hlb;Kkt4^*7%;5I
zF$^hyH7xR08-gRPp1v4vsge9%BwdlX<~Uy7Twh;2e|C0$^YRAzj5{^)3%aZ+
z!f_}1MTmjQwgeyp#vpK5$D~^t0)eCxE>aZy24{1Em5M@ENM&A+$DTh_&2uZmM$uj~
zl1o`$2A1O(hCwPAPTzo4cu}JwN=mm%rMg327Hp?E1PsBMF8i|o_&)S&AmdKxOyX{
z*?HTym8Itqs6|Cu6*||xi6Q6PHaH>L-P_yQ*%^ibG0xz@rurs7-l)t^Q03VjW+QBm
zV$-_NLfC8tXM{aY(BWhoo43wgH)(d3*Pf~L+B4Uyy}i?S-)+$ZfT6<=fH#m>J6m2M
z7K~y!k)J$$vR$06tlK;?iLy`BSOY0`eKWamHS*25J?$E7zXYfFFAfqRmN=KNkDWy13I1IaHi
z%(a=|DAOv*E3qmR(3*c9Py~UNGC7VOY{&I|WVM>2C
zZ@&`4f#X5WUNqZc5aVTxJcNeMoqn2jWxN5LIP#H~-Ai4rcQ~d16=y4zDaO)bEeFL0
z1O#{Nyc)SSB$;4aaLed_s;Uv^rVCF0iY>)0^MYZ8Q?QDB^dIubtpOTT5{0gmMZp7L
zrt(=$8iCVlzdt3;hGh%f}b*ki?itz|%NwVdl~
z^;BNQ7z35SbA5;!gU%u7$PvsjRo~y=CvH;&`K`B3my6}JKXoCKXvR3kIEIk#IkSfh
zT#08c(}jvbs~JSPBRRt4SQ7)ETApDX*Viv@F3vB`&(2@mzOXNc05wz`HXm25(*ae(
zhTuhBtFi1R3n@#9?S>dB#>s%f08-+3{K`8~9k6O#TjA`)1g%a>Ld=H9Bv6>of&}?u
z1cD7VdNvL2SMWK=qLpv
z{2C*{M9~+evy8nLK1&($9?(+&I_R~I)RFJ$=7~BpV#8tZqIz|wzu!H6{P>%1oNjGt
z&t7k|n2!IxF&G6lYoPT8eQk=zQz{obJG;BP%jGh?1cdIymbe!JJInE`ErYfU%zI^{tT
z&#rkhKYRAcljEkRn;Q}RasWf(#@K0MrDSevtth3q|j
zwj=Cl^wvy|bddBoX-Z|*smintG{|$o%y29Z_A)_Us5vhSHf=inPY__#Yt(A$}BlBgMraR+w
z#c>sa(PX)}9b-(Jaw^ByUcPz-qBUN8KYABrJHj~R3#zcHF4b2|cC!DWL26V`3kt%`^wxVYc
zM`El4jbdfSsPQi|#!8H=SOw77k-RV&2?2C;baeXG>7$dA+9#2&(F@zZeQNQ1wDNeZ-Q7|cWA}b-tK{srw6dIV;>z&1d9nl^YXbo305SSIb
z29p|)Y|GASR+^_q97EBF$$By7L;tB}XSK6j?x?;KZOaQenFQUHSKkhc;U^#dED)t5
zO(zs`RqZ>H#Un|~GzmIUMK**}pFAH!0;IN&zyA8WCr{8XO%mTz@qGzLx(9>SB7kS%
zrOvriWAMz_sJxhfL)g{F33A@n87*T%OUX^4;Nx~tsX>YW{kONAEt3}kU_{Zwr9Q!zFZzo)BW}&VhL#_YDlgJynt17aO--<6etvN={kYAL
z9tr8+5+oi^YYze4TwZ!Bs?21C$V^ps{0Ip%0*1=7j8NOmrkzkQIcS!V4^EC7X=mC6
zkRqg)mzPI}hs))%0+LwTX(g5)pLPHyp0s|_-x5-vev^yQ@sgRudA6lUlUS12$s)O7
z85eVUl0O~IMbi%`9k+&Id1^%VZUp+N4C+nDO9PWIEBPclIa(LBV-|s7b}`gP(5XfjRzVNyT3_P1X*bCpM-7>r(qrvW0SH
z>x3=yEVYpy)d;%?4JT~=-IDB`$<1aTgp1GV!TSu_!=sJRg+SSx8HONxC
z6Q0`3xs-HoVt|+;Gq5HCg-Kp-z^y#-;smA?{$hkuS5_i^e);_Q<@4~_=ZA-fCvTme
zJUUq}7hoLi?f>IH{PG`v`O6nCUw-}7SHJ%CuRs0#iySK!SIG;@hYm6XJ;k0=qY{IjZg!Yy7-S`Y5P1j`7D31WVK~s9n1Q-P
z6zR`A{lmm4%VvsWT!%sAKL-(mp4QjI9GQq{ia}FgMhM}(_kKWx`@40>FX}SIX{TpU
zK6`KoOCYYt`w%Gq#$)6`Hl1*uozUbrm^mG@nXM+vQi8uzU{SbbDz`L2-rwI{-`t!(
zzc_n#c7J!5W-d8#%I_5z^&;yt`-(yx6|5qG8iO(jJIy5Juv6t*g+$WuwegeoU`ZWu
z7*L!>WN@U&0fZscpSPJqIV7uGf|==2_6z}F$$vTgKxj<*1U0U8oV_J30Pwh8Ef%T<
zllhu?wz_BS<;k}eFS+Jyl^s~KvuGQnwA?zC*0H%+ZH@pD6D{^pA>F3!$+{75AK
zwM8;-`ny@!X=4W7O~exhUt_!08GR}{ySux)yTdSWd7WO)G;{iF4jzbZYW9Vf%h(BT
z0<*t@^o8fJNrfCse!v@k7>_=zo?(WF9zA-ryt%o&x_TulJ?@$qn6^uQ_6$s!&L#1{!f(rND_XsA
zh~Pmk(2^X+r;m;h0=sB$dsuZDlk8OvyJ2X_f>5Bd{7&-?Y``k2{Ca3I
z!8Jj|ylyAQl3I{;U<%=;^Ori3^)rhf-#k@@M!z=Lu)QKGWxzcOlQy&p#qvl7kx689
zrqHuLAJ0x_IT|9DNxiiJG-=69)l6<6^=Z}#TMZr!Nlt0(I&OljIZ?IjA0DQQXV0D`
zCdrA}s&X^WFjm&6@0~F&$DQC?`Rt
zpez;CM5sp)<+p#{FaRLbpU^&El>o%J1eRftTs?XE^oQ@iKjBP1fop)QF2JT+O1!3s
zbN1s^X=d40#tY=m0EGJ(@5$x}8`CA`khVajB6}6kq*~|Ld*wu;4Xw9ja2+}`Mx@g-
zgF0OVv1X1$G8wj7Nb&rbayzZzIl1g35&ty=Ql*U1%baL~u)VjhjN_E+jHD>P;e2vc
z9pj|xWh)Y@kmS%igyd$=3`-5Qk}8r2Qo(EfImJ#Dx<}MSN+ula!^#JC-7d
zR$4(jF)5f2)B8bdSVeoLAL~mCJ&*WjT_bqzjP|ITA($nOtoAq-PsYm?whe
z)(mf#j8bAo5&Zn>^7-ZE7vYP8gM+tDPft!y7mEb}d%L@T|MQ=}_rt$iESKMY`|Zd7
z{_lVI!yne;=*MRXJ(Dmm5fml`R<0vcpygs&qRAlSGX_KYFHk^^Dc9(8x&lp46KNTi
z28JMG(-Xyk;sQiNAf45uR%%@Sov!rG8zonR>tTZcn0IM-3622ADKnap^OQ^SGh^T(
zG7$yl$T6P2_0}*f658cXSl{0Rpb(0o6Wq!k2#du|jO!R<2%I+?5X;e&)xcAd#Pon-
zh!j~y3`+!=rI8eQ3HNt**EiP}=ND(^XZLsaQ!kg;A1e&gT%2QnRmEIyt6`Qgf=aIH
zJyU^xG{Mu&mQ04yxIjgm=-48KvB
zp8G0SB=qBdrTYylimt|SH7q0sR_zqH(2!t*GJerqAr!n8PiDG9PYyZeF36iKLK0|Y
z*I6;kBeDHReJLpWmjK4@&JNhvLVYg+7Y$e1$nOTMe&lT$R*$c)udXgVm!5Ubty)4U
z^6ZEugyj=Xzj3uJF~%=G`|SGp^By6?XP2SBZPAmIl}lQcY4T7ir5Gygw2^Mpae~X`
zGWpaVt4)SYnW5Ng>zgzYvaUf3Gr3Qd4UD1NE6s+!Ys^z_QSq|O)HjvjHPEc=U2j98
zl%vzrgQKGk`(g`@xunI{Dunt07xy*!3TR8Yy}LU*JA+=LJq(*_*hWGeHwK^!o?c3<
zgWsO3&GiyQ-}3gldF|-4r|!$ETR|gUX#eY?pN0)aM+BE_qyAb_34_42qMj*+__N^K_YhSZF58
zVp011`PIdiQ^xj76hBcKw{NI;PI{{jYVCp0V^Y=^gw$Hp&iin37paNd`qrmK&m-(D
zdAqCaKDHiaZwy8`e)0w5y$?Rv*;xYk*MI%jr%#_U?54EjBBWmDO`d1Kyct9%OJx4?
zi!T~YT4|EznuNUMnq)lrD`n0qBm9WTop;YJrqb{UPNB%9g_=^
zciwt?|KLF8m^&8gBQBCAF}dc?PM^jEYDRnIIJ$~FYHdjTseXs!UI>)8`+(a``)(X#
z+Hh7k^az`kFluyoOpp5+WoDVW@{e>DKWhUZEg%aUGtCo$n(6FJzcC~=&O(SCfMh|RTW=|IF1DUvsEeotpCN(FHX#S2jXOpqhy0sdWC2gvMMOyZhDl|zfb>Eon6k}<
zRGk#C_%|tIV*8fkm|nE7P)lweoChe>tN3Cw0j6mW=$fi56h{Cf5@RHaknfHr4yDUg
zo34nRVU3wl-dCjNj0?J^lC&m^IN1f#{=vb?Tc>Y5I(cz_e{gV^`?a`YdA56F`h{xmXe?gbGv!FLia;Ypr>C@N
zq_=%#BM#6C5yN6)4K)LL8F@j3A?QSIJKs(kn$jo%GImo&qReAxy8n%?zXc
zu4>!dPOX8zJaU{<(o(MRt=M$5>(jPGrm}^^AeWtZbabfZ1;Jhfz=GMk?#60y#&}t>+^h0bM$1gtp^u_gcN4h!u|K(-I>qi8*iWJrSry7mfkbq{#-H($K-sE1ns{m`C#H?YH+14tfZ`?*Mc=?Nn&vl?Sp}
zk;QR*^7QFzGB!hsVq`L*WcGMevU8j6!x(#waInSm1_H~k!9c6LAunzOt4qh}rWxGy
z(dSZJ^x67&hp;V(tYzlVc_G2GSKAlK)ZX6S&T^Ue7H0sXn{2wl=!XZOCBjPNfq1&F
z79Plk$hg)+fUSOwCpT*q=*s4*#y6K2<(s(1`cmU*PGp8ev-s5~>8E8*^k@GX>Si}8
z)~nfDk$?9&F7gJ@&2l%6aTsb70p~}tB+)D0@5#0X46ZkeXJB9zr$c(F
zC7S1d`~F@=7|mGN7Un83IEih?~_KR>$nNmUB*rF>CM&4vb$H%+e02pJ~@
zW>>?7ZO-iJ=7uYy-ujugphe76wkGAUjN7-`AOy5}S;r~N?kM{2n&W+1Y-Bx5;cQq+
zHH<>aA($T78OOU}kTER66a*Xt#j<$lYFY>lS_L-2JeMpLlDsQDCdOty=CXlZU
zDgf;t9-f?>zIAf4+}W8z%m9O9j2Gu;fBMs(Kl<%&udlBG8-w=IXZbxD0mCq)z6~KP
zIL5F@5o8s84mqw&X|s*8DaRD2&H-qu3=jqIlG1%Bq=^WiWsE}(WV7T+40Q3rD9uIn
z?{vY_MG7z{iApT`HjeAOL34~TMWDd|bHr4+7>46Vk3tAJ9L?!35K9nxeSc5s5KB(2
zxy)=j?hP=HF^-}5^2%=piX}P?M#|EL&g8wleR+LzeRg(saefiU(M0-`8`OhMjpdfd
zOxi5(Kd9KPhUDxwNDN!$x22W3;Ic>6ex%#hzV8J(p$ABQl!n0&M`j)XgrRI_Sc!_D
zZFwsuW6G)2P4n^~Eee;iH&UmWm&_rAa`2!}Rc@1P|JY6Yh;=U)ZsB87f|(G({Ipb12eFR!kyuOw%lMo)6qYL&pOMJ@3D
z+-E7t{r&xCpL}xn@@0$KhSD0aZ>%)A^)SlFTGrFkFg7*x*9L7W%blIQ-QC43Jebndycd%luu+$9*tA3W*K_5OZ=}+cV#b_2QPV-}81{m1RHOG_O@=q>
zQQ*o68|-VbX^cW;{ANqG70?*G{;&d5T&$?7NwZ&I2F+eFz4{&uef(1(jl>F48E2#q5H5
zdp$Rhx0XjUi^b-$l3+K0l0+Z067@(7Ar`k=vPwEZBkIR9b7iUzS@+FZ*i$rggNt07
zNp_~l^+V-c;DJ*J`k1-(9Vip__xIm<_gw%lZf^ehpZ{6n48o{->wzZEre+&!l-81-
ze*N{=?d4Vdz9Hmiwy#9$8kLj
zQYdd5Qi083&V9`rqVvuH`sp&pl*?u^d@BRZ#CDk&E14Gk#ZBeA;B`=$>3X>3&Yi9S
zP~)Qnh;bp2G!-F5Ku)=x7#3klF3|emL5n0)S8?+U#6Y{xAY$J_Zw4*$Y)6p+p7;#Y
zz&3fotno8M5J6->Q+=%XiX3lqeumecjMTGaPiG=aJuJq!PUl;4$~&czsAN@_wzlZA
z6J;j8jT%G9?$j7GSCA6%WJRobP;W;V07jaEYDBcZzju22)?25i(-y0uTwYy$_LomT
z`slZ3&(89@t1L~;gPv|ZV*nRy(?IL4G9&hRm4#Tbv{NEj1DWj2SXCmxfy3?2czeDUJy>gwYB{QTm1
zj3Zi6S2;p!WmQzeqZ)^7ryGGpIx!pbHI+I8mt9lOD2la8rQYB!s5OWBew4RGiKSCu
zc-E?}m|faC9IKLq>{-bJ$$84PJw86-=v}Inu5sJZo?$p0LP!La0o^nGQcq}n;^$T1
zsd}aOn%mpk&p!ENeRtPty1D4#{N~G?1@}eX=25RxP3d)f2w``Bf4N+Soa~G(ut~Ht
zoEWekLfXXk40YeIJyzYLCT4H9?0}p6qXq0Hj=8qY=4hevY?x~!QL}lo_>m>cTkpNM
zvs$&D0Kh=h3`_N_cgylR*|sEf*b}@Pyo>R>r{9h3P}{3BR??qk^RxmgpQkxOvj|@!
z^!!R~oA&kU<>6|aafjmObz;z-C2m}m#OEHZFvo@^As~4MXDWl!dy4yz&xvkvzD*g1
z;o#ta(oez01|ule{z+ku$4UNquJ8O)UA~uYv5%`{_31r?CSgrSKxiO3AIPj3R-hw|%W-xQWp7
zgBFaMZ9A!vM)q`V&igLd-hJ=A-Q8UPpMU=O#~*)eddke*=C-Gqrqs~g)LRZQz|2pd
zK7IM(g+$me>=>C5QI91s;v0E;YnbMm$8hWUY?hfO)G>?%5Mo^Dw|PDyXj`!5q2_!Hhf5Z)70QLrv{e>wq8$~?p