ŠĻą”±į>ž’ ž’’’  ’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’ģ„Į'` ųæ0ĶĘbjbj$š$š ."FšFšĶ¾’’’’’’¤®®®®®®®Ā****<f,Ā6æŲž^üüüüüüüµ¾·¾·¾·¾·¾·¾·¾$ĮhvĆ^Ū¾®¤–üü¤–¤–Ū¾®®üüš¾Ņ“Ņ“Ņ“¤–®ü®üµ¾Ņ“¤–µ¾Ņ“Ņ“V»»@®®¼ü’ 00h™Ļ`Ė*Ŗ¦ź ū» ™¾æ06æ¼ ŌƔ“4ŌĆ¼¼¢ŌĆ®µ¼äüœ˜’&Ņ“¾“ģŖ”śüüüŪ¾Ū¾Č“ üüü6椖¤–¤–¤–ĀĀĀdx&~ĀĀĀ&~ĀĀĀ®®®®®®’’’’ Password reset Guide First Guide  HYPERLINK "http://lmobile10.blogspot.om/2010/04/reset-windows-password-tips-4-tricks.html" http://lmobile10.blogspot.om/2010/04/reset-windows-password-tips-4-tricks.html Forgot your administrator password? Don't panic, it happens to some other people too, and you have found the solution! The following instructions will show you step-by-step how to reset your local Windows password. This only works for local user accounts, however, not domain accounts.The password recovery tool from this page is written by Petter Nordahl-Hagen, and the original information, as well as the downloadable tool, can be found from HYPERLINK "http://lmobile10.blogspot.com/" his website. According to the author, this tool should work for Windows NT/2000/XP/Vista. WARNING! Users who have EFS encrypted files on the Windows XP or Vista computers will loose access to the EFS encrypted files after recovery of your password! Use this trick at your own risks The tool to reset your password can be downloaded  HYPERLINK "http://www.thecomputertricks.com/tricks/reset-windows-password/cd070409.zip" here. I. Download the bootdisk: Download the bootdisk, which includes the password recovery tool  HYPERLINK "http://www.thecomputertricks.com/tricks/reset-windows-password/cd070409.zip" here. The file contains the ISO CD image. Unzip (extract) the ISO file and burn it to a CD. Note that this is an ISO file, you must burn it to CD as an ISO image, not as a "data" file. If you're not sure how, see  HYPERLINK "http://lmobile10.blogspot.com/" this article. Also, the image is bootable, you need to burn the image to a CD using the image burning feature; do not extract the contents of the ISO and burn them to the CD, you'll end up with a CD that can't boot! II. Understanding the process: You'll use the bootdisk created from the above steps to bootup your computer, which you want to reset your administrator password. You'll be asked for things like: which drive is the boot drive, which path to the SAM file, etc.. but don't worry, details will be provided. Once you have selected an account to reset the password, you'll need to type in a new password; however, it is highly recommended to use a BLANK password at this point, then you can change your password later in Windows. Follow the prompts to the end. You'll need to save the changes at the end! III. OK! Enough talking. Here are the steps: Startup your computer with the bootdisk created above. You should see a welcome screen following with a prompt: boot: Just wait, the bootup process will continute automatically. Then you should see a screen similar to this: ========================================================= . Step ONE: Select disk where the Windows installation is ========================================================= .... NT partitions found: 1 : /dev/sda1 4001MB Boot 2 : /dev/sda5 2148MB Please select partition by number or a = show all partitions, d = automatically load new disk drivers m = manually load new disk drivers l = relist NTFS/FAT partitions, q = quit Select: [1] Notice the last line "Select: [1]" which shows the [1] as default selection because the tool detected the bootup partition is [1]. This might be different on your own machine, so you should review the list shown under "NT partitions found:". The partition with the word "Boot" should be selected. Hit Enter once you confirm the selection. You should see a similar screen as follows: ========================================================= . Step TWO: Select PATH and registry files ========================================================= .... What is the path to the registry directory? (relative to windows disk) [windows/system32/config] : Notice the last line "[windows/system32/config]" which shows the default path. This was also detected by the tool. If the path is correct, hit Enter, or if you wish to enter a different path, enter it now then hit Enter. Here are the paths for different versions of Windows: - Windows NT 3.51: winnt35/system32/config - Windows NT 4 and Windows 2000: winnt/system32/config - Windows XP/2003 (and often Windows 2000 upgraded from Windows 98 or earlier): windows/system32/config Once you hit "Enter", you should see the next screen similar to the following: -r-------- 1 0 0 262144 Jan 12 18:01 SAM -r-------- 1 0 0 262144 Jan 12 18:01 SECURITY -r-------- 1 0 0 262144 Jan 12 18:01 default -r-------- 1 0 0 8912896 Jan 12 18:01 software -r-------- 1 0 0 2359296 Jan 12 18:01 system dr -x------ 1 0 0 4096 Sep 8 11:37 systemprofile -r-------- 1 0 0 262144 Sep 8 11:53 userdiff Select which part of registry to load, use predefined choices or list the files with space as delimiter 1 - Password reset [sam system security] 2 - RecoveryConsole parameters [software] q - quit - return to previous [1] Hit "Enter" with the default option selected "[1]". Then ...: ========================================================= . Step THREE: Password or registry edit ========================================================= Loaded hives: 1 - Edit user data and passwords 2 - Syskey status & change 3 - RecoveryConsole settings - - - 9 - Registry editor, now with full write support! q - Quit (you will be asked if there is something to save) What to do? [1] -> 1 Hit "Enter" with the default option selected "[1]". Then ...: ===== chntpw Edit User Info & Passwords ==== RID: 01f4, Username: RID: 01f5, Username: , *disabled or locked* RID: 03e8, Username: , *disabled or locked* RID: 03eb, Username: , *disabled or locked* RID: 03ea, Username: , *disabled or locked* Select: ! - quit, . - list users, 0x - User with RID (hex) or simply enter the username to change: [Administrator] Hit "Enter" with the default option selected "[Administrator]", or select another user account. Here you can enter the full user account surrounded by <>, CASE-SENSITIVE, or enter the RID number (i.e. 0x1f4). Assuming you select the Administrator account, you should see the following screen: RID : 0500 [01f4] Username: Administrator fullname: comment : Built-in account for administering the computer/domain homedir : Account bits: 0x0210 = [ ] Disabled | [ ] Homedir req. | [ ] Passwd not req. | [ ] Temp. duplicate | [X] Normal account | [ ] NMS account | [ ] Domain trust ac | [ ] Wks trust act. | [ ] Srv trust act | [X] Pwd don't expir | [ ] Auto lockout | [ ] (unknown 0x08) | [ ] (unknown 0x10) | [ ] (unknown 0x20) | [ ] (unknown 0x40) | Failed login count: 0, while max tries is: 0 Total login count: 3 * = blank the password (This may work better than setting a new password!) Enter nothing to leave it unchanged Please enter new password: * At the prompt "Please enter new password", Enter the * for a blank password (HIGHLY RECOMMENDED!) then press Enter Please enter new password: * Blanking password! Do you really wish to change it? (y/n) [n] y At the prompt, type in "y", then press Enter. Note that the default option is "n". Do you really wish to change it? (y/n) [n] y Changed! Select: ! - quit, . - list users, 0x - User with RID (hex) or simply enter the username to change: [Administrator] ! Enter the "!" to go back to the main menu. Then select "q" at the following menu to quit: <>========<> chntpw Main Interactive Menu <>========<> Loaded hives: 1 - Edit user data and passwords 2 - Syskey status & change 3 - RecoveryConsole settings - - - 9 - Registry editor, now with full write support! q - Quit (you will be asked if there is something to save) What to do? [1] -> q A prompt to save changes displays, enter "y" to save: ========================================================= . Step FOUR: Writing back changes ========================================================= About to write file(s) back! Do it? [n] : y The changes are saved! You should see the following screen, press Enter, and reboot your computer. Writing sam ***** EDIT COMPLETE ***** You can try again if it somehow failed, or you selected wrong New run? [n] : n Second Guide The following is a walkthrough of using the CD to reset one user (admin) on a test Vista computer. Insert the CD and convince your BIOS that it should boot from it. How to boot from a CD varies from computer make to computer make, help on this can be obtained at http://www.hiren.info/pages/bios-boot-cdrom. Some BIOS on booting, show a boot device select menu if you press ESC, F8, F11 or F12 or something like that during the self test. (some even tell you on the screen what to press) When it boots, you should see this: *************************************************************************** * * * Windows NT/2k/XP/Vista/7 Change Password / Registry Editor / Boot CD * * * * (c) 1998-2007 Petter Nordahl-Hagen. Distributed under GNU GPL v2 * * * * DISCLAIMER: THIS SOFTWARE COMES WITH ABSOLUTELY NO WARRANTIES! * * THE AUTHOR CAN NOT BE HELD RESPONSIBLE FOR ANY DAMAGE * * CAUSED BY THE (MIS)USE OF THIS SOFTWARE * * * * More info at: http://pogostick.net/~pnh/ntpasswd/ * * Email : pnh@pogostick.net * * * * CD build date: Sun Sep 23 14:15:35 CEST 2007 * *************************************************************************** Press enter to boot, or give linux kernel boot options first if needed. Some that I have to use once in a while: boot nousb - to turn off USB if not used and it causes problems boot irqpoll - if some drivers hang with irq problem messages boot nodrivers - skip automatic disk driver loading boot: Usually just press enter here. If you have linux knowledge, you can tweak kernel options if you need/like. Then it boots and outputs a lot of kernel messages about your hardware and such.. most if not all are nothing to worry about. Loading vmlinuz.................. Loading scsi.cgz......................... Loading initrd.cgz.......... Ready. Linux version 2.6.22.6 (root@athene) (gcc version 4.1.1 20060724 (prerelease) (4.1.1-3mdk)) #2 Sun Sep 9 16:59:48 CEST 2007 BIOS-provided physical RAM map: BIOS-e820: 0000000000000000 - 000000000009f800 (usable) BIOS-e820: 000000000009f800 - 00000000000a0000 (reserved) BIOS-e820: 00000000000ca000 - 00000000000cc000 (reserved) BIOS-e820: 00000000000dc000 - 0000000000100000 (reserved) BIOS-e820: 0000000000100000 - 00000000316f0000 (usable) BIOS-e820: 00000000316f0000 - 00000000316ff000 (ACPI data) BIOS-e820: 00000000316ff000 - 0000000031700000 (ACPI NVS) BIOS-e820: 0000000031700000 - 0000000031800000 (usable) BIOS-e820: 00000000fec00000 - 00000000fec10000 (reserved) BIOS-e820: 00000000fee00000 - 00000000fee01000 (reserved) BIOS-e820: 00000000fffe0000 - 0000000100000000 (reserved) 792MB LOWMEM available. Zone PFN ranges: DMA 0 -> 4096 Normal 4096 -> 202752 early_node_map[1] active PFN ranges ... Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing enabled serial8250: ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A Floppy drive(s): fd0 is 1.44M FDC 0 is a post-1991 82077 RAMDISK driver initialized: 16 RAM disks of 32000K size 1024 blocksize USB Universal Host Controller Interface driver v3.0 Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. serio: i8042 KBD port at 0x60,0x64 irq 1 serio: i8042 AUX port at 0x60,0x64 irq 12 usbcore: registered new interface driver usbhid drivers/hid/usbhid/hid-core.c: v2.6:USB HID core driver Using IPI Shortcut mode BIOS EDD facility v0.16 2004-Jun-25, 1 devices found Freeing unused kernel memory: 144k freed Booting ntpasswd Mounting: proc sys Ramdisk setup complete, stage separation.. In stage 2 Spawning shells on console 2 - 6 Initialization complete! ** Preparing driver modules to dir /lib/modules/2.6.22.6 input: AT Translated Set 2 keyboard as /class/input/input0 Most of the generic linux boot now done, and we try to load the disk drivers. If you use the floppy version you will be asked to swap floppies at this point. Drivers are then tried based on PCI hardware indentification. ** Will now try to auto-load relevant drivers based on PCI information ---- AUTO DISK DRIVER select ---- --- PROBE FOUND THE FOLLOWING DRIVERS: ata_piix ata_generic mptspi --- TRYING TO LOAD THE DRIVERS ### Loading ata_piix scsi0 : ata_piix scsi1 : ata_piix ata1: PATA max UDMA/33 cmd 0x000101f0 ctl 0x000103f6 bmdma 0x00011050 irq 14 ata2: PATA max UDMA/33 cmd 0x00010170 ctl 0x00010376 bmdma 0x00011058 irq 15 ata2.00: ATAPI: VMware Virtual IDE CDROM Drive, 00000001, max UDMA/33 ata2.00: configured for UDMA/33 scsi 1:0:0:0: CD-ROM NECVMWar VMware IDE CDR10 1.00 PQ: 0 ANSI: 5 sr0: scsi3-mmc drive: 1x/1x xa/form2 cdda tray Uniform CD-ROM driver Revision: 3.20 ### Loading ata_generic ### Loading mptspi Fusion MPT base driver 3.04.04 Copyright (c) 1999-2007 LSI Logic Corporation Fusion MPT SPI Host driver 3.04.04 PCI: Found IRQ 9 for device 0000:00:10.0 mptbase: Initiating ioc0 bringup ioc0: 53C1030: Capabilities={Initiator} scsi2 : ioc0: LSI53C1030, FwRev=01032920h, Ports=1, MaxQ=128, IRQ=9 scsi 2:0:0:0: Direct-Access VMware, VMware Virtual S 1.0 PQ: 0 ANSI: 2 target2:0:0: Beginning Domain Validation target2:0:0: Domain Validation skipping write tests target2:0:0: Ending Domain Validation target2:0:0: FAST-40 WIDE SCSI 80.0 MB/s ST (25 ns, offset 127) sd 2:0:0:0: [sda] 83886080 512-byte hardware sectors (42950 MB) sd 2:0:0:0: [sda] Write Protect is off sd 2:0:0:0: [sda] Cache data unavailable sd 2:0:0:0: [sda] Assuming drive cache: write through sd 2:0:0:0: [sda] 83886080 512-byte hardware sectors (42950 MB) sd 2:0:0:0: [sda] Write Protect is off sd 2:0:0:0: [sda] Cache data unavailable sd 2:0:0:0: [sda] Assuming drive cache: write through sda: sda1 sd 2:0:0:0: [sda] Attached SCSI disk Most of these messages are from the drivers themselves. Some talk a lot, some doesn't. But all give info on the brand and model and size of the disks found, if any. ------------------------------------------------------------- Driver load done, if none loaded, you may try manual instead. ------------------------------------------------------------- ** If no disk show up, you may have to try again (d option) or manual (m). You can later load more drivers.. ************************************************************************* * Windows Registry Edit Utility Floppy / chntpw * * (c) 1997 - 2007 Petter N Hagen - pnh@pogostick.net * * GNU GPL v2 license, see files on CD * * * * This utility will enable you to change or blank the password of * * any user (incl. administrator) on an Windows NT/2k/XP/Vista * * WITHOUT knowing the old password. * * Unlocking locked/disabled accounts also supported. * * * * It also has a registry editor, and there is now support for * * adding and deleting keys and values. * * * * Tested on: NT3.51 & NT4: Workstation, Server, PDC. * * Win2k Prof & Server to SP4. Cannot change AD. * * XP Home & Prof: up to SP2 * * Win 2003 Server (cannot change AD passwords) * * Vista 32 and 64 bit * * * * HINT: If things scroll by too fast, press SHIFT-PGUP/PGDOWN ... * ************************************************************************* ========================================================= There are several steps to go through: - Disk select with optional loading of disk drivers - PATH select, where are the Windows systems files stored - File-select, what parts of registry we need - Then finally the password change or registry edit itself - If changes were made, write them back to disk DON'T PANIC! Usually the defaults are OK, just press enter all the way through the questions ========================================================= ¤ Step ONE: Select disk where the Windows installation is ========================================================= Disks: Disk /dev/sda: 42.9 GB, 42949672960 bytes Candidate Windows partitions found: 1 : /dev/sda1 40958MB BOOT Here it has found one disk with one partition Please select partition by number or q = quit d = automatically start disk drivers m = manually select disk drivers to load f = fetch additional drivers from floppy / usb a = show all partitions found l = show propbable Windows (NTFS) partitions only Select: [1] Here you select one of the partitions listed above (in this case there is only one) or one of the letters from the menu. Floppy users may need to do 'f' to load in more drivers from another floppy. The 'd' option will re-run the PCI scan and start relevant drivers (they must already be loaded from floppy with 'f' option) The 'm' for manual load will present a list of all the drivers with short description if available, and allow you to specify which to load. (Dependecies are handled automatically) Here we only have one partition, so we just press enter to select it. Selected 1 Mounting from /dev/sda1, with filesystem type NTFS NTFS volume version 3.1. It was an NTFS filesystem, and it mounted successfully. ========================================================= ¤ Step TWO: Select PATH and registry files ========================================================= What is the path to the registry directory? (relative to windows disk) [WINDOWS/system32/config] : The registry is usually system32/config under WINDOWS or WINNT directory, depending on the windows version (and it may be changed during installation). If the correct partition has been selected, the default prompt will be adjusted to match if it can find one of the usual variants. We accept the defaults.. and get a (bit filtered) directory listing showing most of the interesting registry files -rw------- 2 0 0 262144 Feb 28 2007 BCD-Template -rw------- 2 0 0 6815744 Sep 23 12:33 COMPONENTS -rw------- 1 0 0 262144 Sep 23 12:33 DEFAULT drwx------ 1 0 0 0 Nov 2 2006 Journal drwx------ 1 0 0 8192 Sep 23 12:33 RegBack -rw------- 1 0 0 524288 Sep 23 12:33 SAM -rw------- 1 0 0 262144 Sep 23 12:33 SECURITY -rw------- 1 0 0 15728640 Sep 23 12:33 SOFTWARE -rw------- 1 0 0 9175040 Sep 23 12:33 SYSTEM drwx------ 1 0 0 4096 Nov 2 2006 TxR drwx------ 1 0 0 4096 Feb 27 2007 systemprofile Select which part of registry to load, use predefined choices or list the files with space as delimiter 1 - Password reset [sam system security] 2 - RecoveryConsole parameters [software] q - quit - return to previous [1] : Choice 1 is for password edit, most used. But if you wish, you can load any of the files (just enter it's name) and do manual registry edit on them. But here, we select 1 for password edit, some files are copied around into memory and the edit application is invoked. Selected files: sam system security Copying sam system security to /tmp ========================================================= ¤ Step THREE: Password or registry edit ========================================================= chntpw version 0.99.5 070923 (decade), (c) Petter N Hagen Hive name (from header): <\SystemRoot\System32\Config\SAM> ROOT KEY at offset: 0x001020 * Subkey indexing type is: 666c Page at 0x44000 is not 'hbin', assuming file contains garbage at end File size 524288 [80000] bytes, containing 11 pages (+ 1 headerpage) Used for data: 288/250904 blocks/bytes, unused: 15/23176 blocks/bytes. Hive name (from header): ROOT KEY at offset: 0x001020 * Subkey indexing type is: 686c Page at 0x8b4000 is not 'hbin', assuming file contains garbage at end File size 9175040 [8c0000] bytes, containing 2117 pages (+ 1 headerpage) Used for data: 96982/6224016 blocks/bytes, unused: 4381/2830032 blocks/bytes. Hive name (from header): ROOT KEY at offset: 0x001020 * Subkey indexing type is: 666c Page at 0x6000 is not 'hbin', assuming file contains garbage at end File size 262144 [40000] bytes, containing 5 pages (+ 1 headerpage) Used for data: 334/17312 blocks/bytes, unused: 7/3008 blocks/bytes. * SAM policy limits: Failed logins before lockout is: 0 Minimum password length : 0 Password history count : 0 ======== chntpw Main Interactive Menu ======== Loaded hives: 1 - Edit user data and passwords 2 - Syskey status & change 3 - RecoveryConsole settings - - - 9 - Registry editor, now with full write support! q - Quit (you will be asked if there is something to save) What to do? [1] -> This demo shows selection 1 for password edit, but you can also do other things. Note that 2, Syskey may be dangerous! AND NOT NEEDED TO RESET PASSWORDS! and does not work at all on Vista, but you get some info before you do any changes. Selection 3, RecoveryConsole is only relevant for Win2k, XP and 2003 and you must have selected to load the SOFTWARE part of the registry (selection 2) earlier. The manual registry editor is always available, it is not the most user-friendly thing, but anyway.. We continue our quest to change our "admin" users password.. ===== chntpw Edit User Info & Passwords ==== | RID -|---------- Username ------------| Admin? |- Lock? --| | 03e8 | admin | ADMIN | | | 01f4 | Administrator | ADMIN | dis/lock | | 03ec | grumf1 | | | | 03ed | grumf2 | | | | 03ee | grumf3 | | | | 01f5 | Guest | | dis/lock | | 03ea | jalla1 | ADMIN | *BLANK* | | 03eb | jalla2 | | *BLANK* | | 03e9 | petro | ADMIN | *BLANK* | This is a list of all local users on the machine. You may see more users here than in the overly user-friendly control panel, for example XP has some help and support built in users. The users marked "ADMIN" are members of the administrators group, which means they have admin rights, if you can login to one of them you can get control of the machine. The buildt in (at install time in all windows versions) administrator is always RID 01f4. This example is from Vista, and Vista by default has this locked down (the installer instead asks and makes another user the regular use administrator, in this case RID 03e8) The "lock?" collumn show if the user account is disabled or locked out (due to many logon attempts for example) or BLANK if the password seems to be blank. We select to edit the "admin" user (this was the user made administrator by the Vista installer) Select: ! - quit, . - list users, 0x - User with RID (hex) or simply enter the username to change: [Administrator] admin RID : 1000 [03e8] Username: admin fullname: comment : homedir : User is member of 1 groups: 00000220 = Administrators (which has 4 members) Group 220 is THE BOSS GROUP! :) Account bits: 0x0214 = [ ] Disabled | [ ] Homedir req. | [X] Passwd not req. | [ ] Temp. duplicate | [X] Normal account | [ ] NMS account | [ ] Domain trust ac | [ ] Wks trust act. | [ ] Srv trust act | [X] Pwd don't expir | [ ] Auto lockout | [ ] (unknown 0x08) | [ ] (unknown 0x10) | [ ] (unknown 0x20) | [ ] (unknown 0x40) | Failed login count: 0, while max tries is: 0 Total login count: 3 Some status info, user is locked out if "Disabled" is set or "Failed login count" is larger than "max tries" policy setting. This user is not locked in any way. The lockout can be reset with option 4 below. - - - - User Edit Menu: 1 - Clear (blank) user password 2 - Edit (set new) user password (careful with this on XP or Vista) 3 - Promote user (make user an administrator) (4 - Unlock and enable user account) [seems unlocked already] q - Quit editing user, back to user select Select: [q] > 1 Password cleared! Here we just reset/clear/blank the password. But you can also try to set a new password with option 2, but it will only work if the password is not blank already. Also, it often fails to work on XP and newer systems. Number 3 is to put a non-admin user into the administrators (220) group, thus making the user an administrator. IT IS STILL EXPERIMENTAL AND IT MAY sometimes RESULT IN STRANGE ERRORS WHEN LATER EDITING THE GROUP FROM WINDOWS! Also, usually pointless in promoting the Guest user, as it is most likely forbidden to log in by the security policy settings. Select: ! - quit, . - list users, 0x - User with RID (hex) or simply enter the username to change: [Administrator] ! Exclamation point ! quits out (it's SHIFT 1 on the US keyboard layout used on the boot CD) Then we get back to the main menu, and select to quit.. ======== chntpw Main Interactive Menu ======== Loaded hives: 1 - Edit user data and passwords 2 - Syskey status & change 3 - RecoveryConsole settings - - - 9 - Registry editor, now with full write support! q - Quit (you will be asked if there is something to save) What to do? [1] -> q Hives that have changed: # Name 0 - OK ========================================================= ¤ Step FOUR: Writing back changes ========================================================= About to write file(s) back! Do it? [n] : y You must answer y, or the changes will not be saved. This is the last chance to change your mind! Writing sam Only changed files of the registry are actually written back. If you forgot something, you may run again, else press CTRL-ALT-DEL to reboot. ***** EDIT COMPLETE ***** You can try again if it somehow failed, or you selected wrong New run? [n] : n ========================================================= * end of scripts.. returning to the shell.. * Press CTRL-ALT-DEL to reboot now (remove floppy first) * or do whatever you want from the shell.. * However, if you mount something, remember to umount before reboot * You may also restart the script procedure with 'sh /scripts/main.sh' (Please ignore the message about job control, it is not relevant) BusyBox v1.1.0-pre1 (2005.12.30-19:45+0000) Built-in shell (ash) Enter 'help' for a list of built-in commands. sh: can't access tty; job control turned off See the software’s FAQ section at - http://pogostick.net/~pnh/ntpasswd/ Thired Guide The following is a walkthrough of using the CD to reset one user (admin) on a test Vista and a Win 7 computer. - 6/5/2010 (HIGHLIGHTED IN RED ARE AREAS THAT COMMON MISTAKES ARE MADE DURING THE OPERATION, they are simple but easy mistakes to make) Insert the CD and convince your BIOS that it should boot from it. How to boot from a CD varies from computer make to computer make, so I cannot help you much. Some BIOS shows a boot device select menu if you press ESC, F8, F11 or F12 or something like that during the self test. (some even tell you on the screen what to press) If it boots, you should see this: ISOLINUX 3.51 2007-06-10 Copyright (C) 1994-2007 H. Peter Anvin *************************************************************************** * * * Windows NT/2k/XP/Vista Change Password / Registry Editor / Boot CD * * * * (c) 1998-2007 Petter Nordahl-Hagen. Distributed under GNU GPL v2 * * * * DISCLAIMER: THIS SOFTWARE COMES WITH ABSOLUTELY NO WARRANTIES! * * THE AUTHOR CAN NOT BE HELD RESPONSIBLE FOR ANY DAMAGE * * CAUSED BY THE (MIS)USE OF THIS SOFTWARE * * * * More info at: http://pogostick.net/~pnh/ntpasswd/ * * Email : pnh@pogostick.net * * * * CD build date: Sun Sep 23 14:15:35 CEST 2007 * *************************************************************************** Press enter to boot, or give linux kernel boot options first if needed. Some that I have to use once in a while: boot nousb - to turn off USB if not used and it causes problems boot irqpoll - if some drivers hang with irq problem messages boot nodrivers - skip automatic disk driver loading boot: Usually just press enter here. If you have linux knowledge, you can tweak kernel options if you need/like. Then it boots and outputs a lot of kernel messages about your hardware and such.. most if not all are nothing to worry about. Loading vmlinuz.................. Loading scsi.cgz......................... Loading initrd.cgz.......... Ready. Linux version 2.6.22.6 (root@athene) (gcc version 4.1.1 20060724 (prerelease) (4.1.1-3mdk)) #2 Sun Sep 9 16:59:48 CEST 2007 BIOS-provided physical RAM map: BIOS-e820: 0000000000000000 - 000000000009f800 (usable) BIOS-e820: 000000000009f800 - 00000000000a0000 (reserved) BIOS-e820: 00000000000ca000 - 00000000000cc000 (reserved) BIOS-e820: 00000000000dc000 - 0000000000100000 (reserved) BIOS-e820: 0000000000100000 - 00000000316f0000 (usable) BIOS-e820: 00000000316f0000 - 00000000316ff000 (ACPI data) BIOS-e820: 00000000316ff000 - 0000000031700000 (ACPI NVS) BIOS-e820: 0000000031700000 - 0000000031800000 (usable) BIOS-e820: 00000000fec00000 - 00000000fec10000 (reserved) BIOS-e820: 00000000fee00000 - 00000000fee01000 (reserved) BIOS-e820: 00000000fffe0000 - 0000000100000000 (reserved) 792MB LOWMEM available. Zone PFN ranges: DMA 0 -> 4096 Normal 4096 -> 202752 early_node_map[1] active PFN ranges ... Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing enabled serial8250: ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A Floppy drive(s): fd0 is 1.44M FDC 0 is a post-1991 82077 RAMDISK driver initialized: 16 RAM disks of 32000K size 1024 blocksize USB Universal Host Controller Interface driver v3.0 Initializing USB Mass Storage driver... usbcore: registered new interface driver usb-storage USB Mass Storage support registered. serio: i8042 KBD port at 0x60,0x64 irq 1 serio: i8042 AUX port at 0x60,0x64 irq 12 usbcore: registered new interface driver usbhid drivers/hid/usbhid/hid-core.c: v2.6:USB HID core driver Using IPI Shortcut mode BIOS EDD facility v0.16 2004-Jun-25, 1 devices found Freeing unused kernel memory: 144k freed Booting ntpasswd Mounting: proc sys Ramdisk setup complete, stage separation.. In stage 2 Spawning shells on console 2 - 6 Initialization complete! ** Preparing driver modules to dir /lib/modules/2.6.22.6 input: AT Translated Set 2 keyboard as /class/input/input0 Most of the generic linux boot now done, and we try to load the disk drivers. If you use the floppy version you will be asked to swap floppies at this point. Drivers are then tried based on PCI hardware indentification. ** Will now try to auto-load relevant drivers based on PCI information ---- AUTO DISK DRIVER select ---- --- PROBE FOUND THE FOLLOWING DRIVERS: ata_piix ata_generic mptspi --- TRYING TO LOAD THE DRIVERS ### Loading ata_piix scsi0 : ata_piix scsi1 : ata_piix ata1: PATA max UDMA/33 cmd 0x000101f0 ctl 0x000103f6 bmdma 0x00011050 irq 14 ata2: PATA max UDMA/33 cmd 0x00010170 ctl 0x00010376 bmdma 0x00011058 irq 15 ata2.00: ATAPI: VMware Virtual IDE CDROM Drive, 00000001, max UDMA/33 ata2.00: configured for UDMA/33 scsi 1:0:0:0: CD-ROM NECVMWar VMware IDE CDR10 1.00 PQ: 0 ANSI: 5 sr0: scsi3-mmc drive: 1x/1x xa/form2 cdda tray Uniform CD-ROM driver Revision: 3.20 ### Loading ata_generic ### Loading mptspi Fusion MPT base driver 3.04.04 Copyright (c) 1999-2007 LSI Logic Corporation Fusion MPT SPI Host driver 3.04.04 PCI: Found IRQ 9 for device 0000:00:10.0 mptbase: Initiating ioc0 bringup ioc0: 53C1030: Capabilities={Initiator} scsi2 : ioc0: LSI53C1030, FwRev=01032920h, Ports=1, MaxQ=128, IRQ=9 scsi 2:0:0:0: Direct-Access VMware, VMware Virtual S 1.0 PQ: 0 ANSI: 2 target2:0:0: Beginning Domain Validation target2:0:0: Domain Validation skipping write tests target2:0:0: Ending Domain Validation target2:0:0: FAST-40 WIDE SCSI 80.0 MB/s ST (25 ns, offset 127) sd 2:0:0:0: [sda] 83886080 512-byte hardware sectors (42950 MB) sd 2:0:0:0: [sda] Write Protect is off sd 2:0:0:0: [sda] Cache data unavailable sd 2:0:0:0: [sda] Assuming drive cache: write through sd 2:0:0:0: [sda] 83886080 512-byte hardware sectors (42950 MB) sd 2:0:0:0: [sda] Write Protect is off sd 2:0:0:0: [sda] Cache data unavailable sd 2:0:0:0: [sda] Assuming drive cache: write through sda: sda1 sd 2:0:0:0: [sda] Attached SCSI disk Most of these messages are from the drivers themselves. Some talk a lot, some doesn't. But all give info on the brand and model and size of the disks found, if any. ------------------------------------------------------------- Driver load done, if none loaded, you may try manual instead. ------------------------------------------------------------- ** If no disk show up, you may have to try again (d option) or manual (m). You can later load more drivers.. ************************************************************************* * Windows Registry Edit Utility Floppy / chntpw * * (c) 1997 - 2007 Petter N Hagen - pnh@pogostick.net * * GNU GPL v2 license, see files on CD * * * * This utility will enable you to change or blank the password of * * any user (incl. administrator) on an Windows NT/2k/XP/Vista * * WITHOUT knowing the old password. * * Unlocking locked/disabled accounts also supported. * * * * It also has a registry editor, and there is now support for * * adding and deleting keys and values. * * * * Tested on: NT3.51 & NT4: Workstation, Server, PDC. * * Win2k Prof & Server to SP4. Cannot change AD. * * XP Home & Prof: up to SP2 * * Win 2003 Server (cannot change AD passwords) * * Vista 32 and 64 bit * * * * HINT: If things scroll by too fast, press SHIFT-PGUP/PGDOWN ... * ************************************************************************* ========================================================= There are several steps to go through: - Disk select with optional loading of disk drivers - PATH select, where are the Windows systems files stored - File-select, what parts of registry we need - Then finally the password change or registry edit itself - If changes were made, write them back to disk DON'T PANIC! Usually the defaults are OK, just press enter all the way through the questions ========================================================= ¤ Step ONE: Select disk where the Windows installation is ========================================================= Disks: Disk /dev/sda: 42.9 GB, 42949672960 bytes Candidate Windows partitions found: 1 : /dev/sda1 40958MB BOOT Here it has found one disk with one partition (most windows installations are made on the 1st listed partition , but could be on any listed, correct partition is usually marked as ‘BOOT’) Please select partition by number or q = quit d = automatically start disk drivers m = manually select disk drivers to load f = fetch additional drivers from floppy / usb a = show all partitions found l = show propbable Windows (NTFS) partitions only Select: [1] (enter number from partitions found) Here you select one of the partitions listed above (in this case there is only one) or one of the letters from the menu. Floppy users may need to do 'f' to load in more drivers from another floppy. The 'd' option will re-run the PCI scan and start relevant drivers (they must already be loaded from floppy with 'f' option) The 'm' for manual load will present a list of all the drivers with short description if available, and allow you to specify which to load. (Dependecies are handled automatically) Here we only have one partition, so we just press enter to select it. Selected 1 Mounting from /dev/sda1, with filesystem type NTFS NTFS volume version 3.1. It was an NTFS filesystem, and it mounted successfully. (filesystem must be NTFS for this software to work – 99% are) ========================================================= ¤ Step TWO: Select PATH and registry files ========================================================= What is the path to the registry directory? (relative to windows disk) [WINDOWS/system32/config] : (This is the norm on standard windows installations) The registry is usually system32/config under WINDOWS or WINNT directory, depending on the windows version (and it may be changed during installation). If the correct partition has been selected, the default prompt will be adjusted to match if it can find one of the usual variants. We accept the defaults.. and get a (bit filtered) directory listing showing most of the interesting registry files -rw------- 2 0 0 262144 Feb 28 2007 BCD-Template -rw------- 2 0 0 6815744 Sep 23 12:33 COMPONENTS -rw------- 1 0 0 262144 Sep 23 12:33 DEFAULT drwx------ 1 0 0 0 Nov 2 2006 Journal drwx------ 1 0 0 8192 Sep 23 12:33 RegBack -rw------- 1 0 0 524288 Sep 23 12:33 SAM -rw------- 1 0 0 262144 Sep 23 12:33 SECURITY -rw------- 1 0 0 15728640 Sep 23 12:33 SOFTWARE -rw------- 1 0 0 9175040 Sep 23 12:33 SYSTEM drwx------ 1 0 0 4096 Nov 2 2006 TxR drwx------ 1 0 0 4096 Feb 27 2007 systemprofile Select which part of registry to load, use predefined choices or list the files with space as delimiter 1 - Password reset [sam system security] 2 - RecoveryConsole parameters [software] q - quit - return to previous [1] : Choice 1 is for password edit, most used. But if you wish, you can load any of the files (just enter it's name) and do manual registry edit on them. But here, we select 1 for password edit, some files are copied around into memory and the edit application is invoked. Selected files: sam system security Copying sam system security to /tmp (ensure that you get this message) ========================================================= ¤ Step THREE: Password or registry edit ========================================================= chntpw version 0.99.5 070923 (decade), (c) Petter N Hagen Hive name (from header): <\SystemRoot\System32\Config\SAM> ROOT KEY at offset: 0x001020 * Subkey indexing type is: 666c Page at 0x44000 is not 'hbin', assuming file contains garbage at end File size 524288 [80000] bytes, containing 11 pages (+ 1 headerpage) Used for data: 288/250904 blocks/bytes, unused: 15/23176 blocks/bytes. Hive name (from header): ROOT KEY at offset: 0x001020 * Subkey indexing type is: 686c Page at 0x8b4000 is not 'hbin', assuming file contains garbage at end File size 9175040 [8c0000] bytes, containing 2117 pages (+ 1 headerpage) Used for data: 96982/6224016 blocks/bytes, unused: 4381/2830032 blocks/bytes. Hive name (from header): ROOT KEY at offset: 0x001020 * Subkey indexing type is: 666c Page at 0x6000 is not 'hbin', assuming file contains garbage at end File size 262144 [40000] bytes, containing 5 pages (+ 1 headerpage) Used for data: 334/17312 blocks/bytes, unused: 7/3008 blocks/bytes. * SAM policy limits: Failed logins before lockout is: 0 Minimum password length : 0 Password history count : 0 ======== chntpw Main Interactive Menu ======== Loaded hives: 1 - Edit user data and passwords 2 - Syskey status & change 3 - RecoveryConsole settings - - - 9 - Registry editor, now with full write support! q - Quit (you will be asked if there is something to save) What to do? [1] -> This demo shows selection 1 for password edit, but you can also do other things. Note that 2, Syskey may be dangerous! AND NOT NEEDED TO RESET PASSWORDS! and does not work at all on Vista, but you get some info before you do any changes. Selection 3, RecoveryConsole is only relevant for Win2k, XP and 2003 and you must have selected to load the SOFTWARE part of the registry (selection 2) earlier. The manual registry editor is always available, it is not the most user-friendly thing, but anyway.. We continue our quest to change our "admin" users password.. ===== chntpw Edit User Info & Passwords ==== | RID -|---------- Username ------------| Admin? |- Lock? --| | 03e8 | admin | ADMIN | | | 01f4 | Administrator | ADMIN | dis/lock | | 03ec | grumf1 | | | | 03ed | grumf2 | | | | 03ee | grumf3 | | | | 01f5 | Guest | | dis/lock | | 03ea | jalla1 | ADMIN | *BLANK* | | 03eb | jalla2 | | *BLANK* | | 03e9 | petro | ADMIN | *BLANK* | This is a list of all local users on the machine. You may see more users here than in the overly user-friendly control panel, for example XP has some help and support built in users. The users marked "ADMIN" are members of the administrators group, which means they have admin rights, if you can login to one of them you can get control of the machine. The buildt in (at install time in all windows versions) administrator is always RID 01f4. This example is from Vista, and Vista by default has this locked down (the installer instead asks and makes another user the regular use administrator, in this case RID 03e8) The "lock?" collumn show if the user account is disabled or locked out (due to many logon attempts for example) or BLANK if the password seems to be blank. We select to edit the "admin" user (this was the user made administrator by the Vista installer) Select: ! - quit, . - list users, 0x - User with RID (hex) or simply enter the username to change: [Administrator] admin RID : 1000 [03e8] Username: admin (type name exactly as shown in table fullname: ie – admin not ADMIN or Admin) comment : homedir : User is member of 1 groups: 00000220 = Administrators (which has 4 members) Group 220 is THE BOSS GROUP! :) Account bits: 0x0214 = [ ] Disabled | [ ] Homedir req. | [X] Passwd not req. | [ ] Temp. duplicate | [X] Normal account | [ ] NMS account | [ ] Domain trust ac | [ ] Wks trust act. | [ ] Srv trust act | [X] Pwd don't expir | [ ] Auto lockout | [ ] (unknown 0x08) | [ ] (unknown 0x10) | [ ] (unknown 0x20) | [ ] (unknown 0x40) | Failed login count: 0, while max tries is: 0 Total login count: 3 Some status info, user is locked out if "Disabled" is set or "Failed login count" is larger than "max tries" policy setting. This user is not locked in any way. The lockout can be reset with option 4 below. - - - - User Edit Menu: 1 - Clear (blank) user password 2 - Edit (set new) user password (careful with this on XP or Vista) 3 - Promote user (make user an administrator) (4 - Unlock and enable user account) [seems unlocked already] q - Quit editing user, back to user select Select: [q] > 1 Password cleared! Here we just reset/clear/blank the password. But you can also try to set a new password with option 2, but it will only work if the password is not blank already. Also, it often fails to work on XP and newer systems. Number 3 is to put a non-admin user into the administrators (220) group, thus making the user an administrator. IT IS STILL EXPERIMENTAL AND IT MAY sometimes RESULT IN STRANGE ERRORS WHEN LATER EDITING THE GROUP FROM WINDOWS! Also, usually pointless in promoting the Guest user, as it is most likely forbidden to log in by the security policy settings. Select: ! - quit, . - list users, 0x - User with RID (hex) or simply enter the username to change: [Administrator] ! Note this is not a 1 it is an Exclamation point ! quits out (it's SHIFT 1 on the US and UK keyboard layouts used on the boot CD) Then we get back to the main menu, and select to quit.. ======== chntpw Main Interactive Menu ======== Loaded hives: 1 - Edit user data and passwords 2 - Syskey status & change 3 - RecoveryConsole settings - - - 9 - Registry editor, now with full write support! q - Quit (you will be asked if there is something to save) What to do? [1] -> q Hives that have changed: # Name 0 - OK ========================================================= ¤ Step FOUR: Writing back changes ========================================================= About to write file(s) back! Do it? [n] : y You must answer y, or the changes will not be saved. This is the last chance to change your mind! Writing sam Only changed files of the registry are actually written back. If you forgot something, you may run again, else press CTRL-ALT-DEL to reboot. ***** EDIT COMPLETE ***** You can try again if it somehow failed, or you selected wrong New run? [n] : n ========================================================= * end of scripts.. returning to the shell.. * Press CTRL-ALT-DEL to reboot now (remove floppy first) * or do whatever you want from the shell.. * However, if you mount something, remember to umount before reboot * You may also restart the script procedure with 'sh /scripts/main.sh' (Please ignore the message about job control, it is not relevant)  !".|~€ĪĻŠģŪŹ¶¢|h|M=, honJ5>*B*CJ \aJ ph’h‰~shßW!0J5CJ \aJ 5jh‰~shßW!5>*B*CJ U\aJ ph’&hßW!hßW!5>*B*CJ \aJ ph’ hßW!5>*B*CJ \aJ ph’)jhßW!5>*B*CJ U\aJ ph’&hßW!hßW!5>*B*CJH\aJHph’’&h­G£hßW!5>*B*CJH\aJHph’’ hßW!5>*B*CJH\aJHph’’ hõļ5>*B*CJ \aJ ph’&hõļhõļ5>*B*CJ \aJ ph’!ŠŃ( € Ó & €   ] » Ü p q ‹ åŻååĘĘĘĘĘĘĘĘĘĘʶĘdP-DMĘ ’’’’gdõļdP¤d¤d-DMĘ ’’’’[$\$gdõļ$a$gdßW!$dP¤d¤d-DMĘ ’’’’[$\$a$gdõļĶĘžŠŃ? F P [ ‘ ’ ¾ æ Ź Ė Ś ä G M c l x  » Ū č ū    h i m n p q Š ‹ µ Ę Ģ Ķ & ģŽĪŽĪŽ»Ž»­»ŽĪŽĪŽĪŽĪŽœŽĪŽĪŽ»Ž»­»Ž€vŽfŽ»Žhõļhõļ0J5B*\ph"""hõļhõļ5\hõļhõļ5>*B*\ph"""hõļhõļ0J5\!hõļhõļ56B*\]ph"""hõļhõļ5B* \ph8|$jhõļhõļ5B*U\ph"""hõļhõļ0J5B*\ph"""hõļhõļ5B*\ph"""&hõļhonJ5>*B*CJ \aJ ph’(& ' + , ./;<QY  ()*nv–£U_‘IPij–—ĪŲļųķßķßķßķßķßĻßĆ³”³—߇߇߇߇߇ßĆ³—ßĻßĻßuc#hõļhõļ5B*CJ\aJph"""#hõļhõļ5B*OJQJ\ph"""hõļhõļ0J5B*\ph"""hõļhõļ5\"hõļhõļ0J5>*B*\ph"""hõļhõļ5>*B*\ph"""hõļhõļ0J5\hõļhõļ0J5B*\ph"""hõļhõļ5B*\ph"""$jhõļhõļ5B*U\ph"""&‹ / T ¦ ļ h“  *yÆ>ŒŃiąąąąąąąŠ¹šššššššš & F„idį¤d¤d-DMĘ ’’’’[$\$^„igdõļdP¤d¤d-DMĘ ’’’’[$\$gdõļdP-DMĘ ’’’’gdõļ & F„wdį¤d¤d-DMĘ ’’’’[$\$^„wgdõļij—ąa{øō5t³÷<S š0ļŲ¹¹„¹¹„„„„„„„„¹¹¹„wdį-DMĘ ’’’’^„wgdõļ & F„wdį¤d¤d-DMĘ ’’’’[$\$^„wgdõļdP¤d¤d-DMĘ ’’’’[$\$gdõļdP-DMĘ ’’’’gdõļ=Jz{ŠŁāīSZbit†‰ŅÕóū1EeiŌՁŒ•”ēż`jėóŒ”Ļż  Üå7F½ģļūüs¢±› œ ("4"##ńįńĻ½„½„½ńįńĻńĻńĻńįńĻńĻńĻ½„½„½ńĻńįńįńĻ½„½„½ńĻńĻ½„½„½ńĻńĻ½ńĻńĻ½„½„/hõļhõļ0J5B*CJOJQJ\aJph"""#hõļhõļ5B*CJ\aJph"""#hõļhõļ5B*OJQJ\ph"""hõļhõļ0J5B*\ph"""hõļhõļ5B*\ph"""A0Õ?Źē)ĘS—Ł_„é,hāĆÆÆÆÆÆĆĆāĆÆÆÆÆÆÆÆÆÆ„wdį-DMĘ ’’’’^„wgdõļ & F„wdį¤d¤d-DMĘ ’’’’[$\$^„wgdõļ & F„wdį¤d¤š-DMĘ ’’’’[$^„wgdõļhŖĻ LsÆź2i§½¾ü8r«åbstėėĢėėėėėėėėµĢėėėėėėėµ„wdį-DMĘ ’’’’[$\$^„wgdõļ & F„wdį¤d¤d-DMĘ ’’’’[$\$^„wgdõļ„wdį-DMĘ ’’’’^„wgdõļtæ \ œ Ł !l#m#±#į#$D$E$˜$Ó$%K%L%¦%é&ź&ąąąąĢĢĢµąąĢĢµąĢĢĢµąĢµ„wdį-DMĘ ’’’’[$\$^„wgdõļ„wdį-DMĘ ’’’’^„wgdõļ & F„wdį¤d¤d-DMĘ ’’’’[$\$^„wgdõļ#l#|#•#¢#£#ą#į#D$]$^$—$˜$K%W%X%„%…%„%¦%Ą%Ė%é&''' 'Ć'Ė'ź'M(N(Ė(Ģ(Ķ(Ń(Ž(ß(æ)ē)**ķßĶßĶßĶķßĶßĶķßĶßĶßĶķµķßĶßĶķµķßĶķ±­œˆ­}uj}h:›h­G£B*ph’h­G£B*ph™3fh:›h­G£B*ph™3f&h­G£h­G£5>*B*CJH\aJHph’’ h­G£5>*B*CJH\aJHph’’h­G£h: /hõļhõļ0J5B*CJOJQJ\aJph"""#hõļhõļ5B*OJQJ\ph"""hõļhõļ5B*\ph"""#hõļhõļ5B*CJ\aJph""")ź& '^''½'ź'ė'N((Ė(Ģ(Ķ(Ī(Ļ(Š(Ń(Ž(ß(C)ąĢĢĢĢµąĢĢ³³«««¦«³”gd­G£gdI|$a$gd­G£„wdį-DMĘ ’’’’[$\$^„wgdõļ„wdį-DMĘ ’’’’^„wgdõļ & F„wdį¤d¤d-DMĘ ’’’’[$\$^„wgdõļ*.*H*I*Ź*Ń*ļ*Ń0¼1-: ;$BŹBŪCžC[MŠM©NėPLQ…Q“R$TļWžXõ_+bŻdIhhiŠi@kl[m˜opØpsiszs tģvwww#w)w*w+w¦w"x³Šœœmœ÷ģ÷ģ÷ģčģčģčģčģčģčģčģčģčģčģčģčģčģčģčģčģčģčįčŠæ«æ£č™čŽčŽčh†LÕh­G£B*ph’h­G£5B*ph’h­G£B*ph’’&h­G£h­G£5>*B*CJH\aJHph’’ h­G£5>*B*CJH\aJHph’’ hßW!5>*B*CJH\aJHph’’ hIe×h­G£h­G£h:›h­G£B*ph™3fh­G£B*ph™3f7C)Ź*ļ*š*ń*?++Ż++,y,Ē,-c-±-’-M.›.é.7/…/†/Š/ū/F00Č0É0Ń0=1śśõõõõõõõõõõõõõõõõõõõõõõõõõśgd­G£gd­G£=1¼1½1į1 22-262“2Ö23N3‹3Č34A4~4¹4ö435p5Š55æ5į566 66śõõõõõõõõõõõõõõõõõõõõõõõõõõõgd­G£gd­G£6Y66°6Ķ67L7v7­7Ō7’7+8]8—8±8č89&9;9h9u9˜9³9“9ļ9,:-: ;S;śśśśśśśśśśśśśśśśśśśśśśśśśśõśgd­G£gd­G£S;T;x;”;¬;ŗ;Ć;ä;ū;<!<p<æ<=)=x=©=Š=Ń=ė=ģ=>">R>w>¢>Å>ļ>5?„?śśśśśśśśśśśśśśśśśśśśśśśśśśśśśgd­G£„?°?ē?@S@•@¾@é@!AcAŒA·AļAüA#B$BŹBĖB CKC‹CŒCCŚCŪCžC’CKD—Dśśśśśśśśśśśśśśśõśśśśśśśśõśśśgd­G£gd­G£—DćD/E{EĒEF_F«F÷FCGGŪG'HsHæH IWI£IļI;J^c^ˆ^­^®^Æ^ą^į^ō^õ^_9_Z_h_ž_Ż_Ž_śśśśśśśśśśśśśśśśśśśśśśśśśśśśśgd­G£Ž_ß_ō_õ_G`å`‡aķa+b,b[b\bœbÜbc\cœcÜcd\dœdÜdŻd•e@fJgēgIhJhśśśõššššśśśśśśśśśśśśśśõššššśgd­G£gd­G£gd­G£Jh‡hĒhČhąhņhžh iii5igihi‰iŠi£iēi+joj³j÷jųj'k?k@kll+lNlśśśśśśśśśśśśõśśśśśśśśśśśõśśśgd­G£gd­G£Nl•lĘlm4mFmZm[m‰m6n˜o™oÖoppopØp©pŚpŪpqq+qJqkqyqÆqīqļqśśśśśśśõššśśśśõšśśśśśśśśśśśśgd­G£gd­G£gd­G£ļqšqrr#r.r:r;rwr›r×rssisjsyszs¹s t t&t'tgtzt¶t·tåt uMuśśśśśśśśśśśśõśśśššśśśśśśśśśśgd­G£gd­G£gd­G£Mu“uÜuŻu!v"v#vfv–v—vĘvĒvČvwwwwwwwwwwwwww*w+wśśśśśśśśśśśśśųųųųššššššššššš$a$gd­G£gd­G£+w¦w$xmyyÓyŌyÕy#zqzæz {[{©{÷{E|“|į|/}}}Ė}~g~h~²~Ż~(oŖśśśśõõõõõõõõõõõõõõõõõõõõõõõõgd­G£gd­G£Ŗ«³€ž€Ÿ€Ć€ļ€š€–øó0‚m‚Ŗ‚å‚#ƒ`ƒ›ƒŲƒ„R„l„„”„Ć„é„śśõõśśśśśśśśśśśśśśśśśśśśśśśśgd­G£gd­G£鄼„ļ„š„;…r…’…Æ…ų….†X††¶†į† ‡?‡y‡“‡Ź‡õ‡ˆˆJˆWˆzˆ•ˆ–ˆŃˆ‰‰śśśśśśśśśśśśśśśśśśśśśśśśśśśśśgd­G£‰ģ‰5Š6ŠZŠƒŠŽŠœŠ„ŠĘŠŻŠšŠ‹R‹”‹é‹ ŒZŒ‹Œ²Œ³ŒĶŒĪŒćŒ4Y„§śõõõõõõõõõõõõõõõõõõõõõõõõõõõgd­G£gd­G£§ŃŽfŽ’ŽÉŽņŽ5w ĖEn™ŃŽ‘‘¬‘­‘ķ‘-’m’n’o’¼’½’ą’śśśśśśśśśśśśśśśśśśõśśśśśśśśõgd­G£gd­G£ą’į’-“y“Å“”]”©”õ”A••Ł•%–q–½– —U—”—ķ—9˜…˜Ń˜™™Z™ƒ™¹™õ™%šbšśśśśśśśśśśśśśśśśśśśśśśśśśśśśśgd­G£bš”š•šŅš››@›|›ø›¹›Ā›ī›ļ›š›œ=œ>œmœūœüœ#/WƒµÖ ž>ž?žśśśśśśśśśśśśśśśśõõśśśśśśśśśśgd­G£gd­G£mœšœœœśœūœž=ž”W”X”j¢ž¢Ÿ¢¾„Į„ü„¦‚¦ˆ¦Y©{©|©Ų²Ż².¹R¹S¹a¹~¹¹%Ą&Ą•ĄĮ®ĆæĆÅ!ÅÉĘŹĘĖĘĢĘĶĘ÷ź÷ßŪßŪ÷ßŪ÷ßŪßŪßŪßŪ÷ŠŪŠŪ÷ŠŪŠ÷ŪĆŪĆŪŠŪøŪ­œˆŪ&h­G£h­G£5>*B*CJH\aJHph’’ h­G£5>*B*CJH\aJHph’’h­G£h­G£B*ph’’h†qh­G£B*ph’h—c¢h­G£5B*ph’h—c¢h­G£B*ph’h­G£h†LÕh­G£B*ph’h†LÕh­G£B*H*ph’h­G£B*ph’*?ž¹žŸ…Ÿ:  ‚   Å Ę į ā X”Y”•”Ā”ž”G¢Ÿ¢ ¢9£½£1¤2¤y¤¾¤„B„śśśśśõõõõõõõśõõõõõõõšśśõõõõõgd­G£gd­G£gd­G£B„„„Ā„¦H¦‰¦Ē¦§§P§|§§§Ó§ó§ū§ü§'Ø“Ø © ©2©|©}©¹©ć©Ŗ[Ŗ™ŖŻŖśśśśśśśśśśśśśśśõššśśśśśśśśśśgd­G£gd­G£gd­G£ŻŖ$«k«“«µ«Ś«¬f¬±¬­­@­„­Ź­®V®W®X®o®”®¹®Ž®ß®ą®ÆÆ%Æ&ÆKÆjÆśśśśśśśśśśśśśśśśśśśśśśśśśśśśśgd­G£jƋƙÆĻÆ°°°%°&°x°±ø±²\²]²Œ²²Ķ² ³M³³Ķ³ “M““Ķ“ µµĘµśśśśśśśśõššššśśśśśśśśśśśśśśõgd­G£gd­G£gd­G£ʵq¶{·øzø{øøøųøłø¹S¹€¹Œ¹˜¹™¹·¹é¹ź¹ ŗ ŗ%ŗiŗ­ŗńŗ5»y»z»©»Į»śśśśõõõõõõõõõõõõõšõõõõõõõõõõgd­G£gd­G£gd­G£Į»Ā»’¼“¼­¼Š¼½H½ˆ½¶½Č½Ü½Ż½ ¾ø¾ĄĄXĄ”Ą•ĄĮPĮQĮ‚ĮƒĮ­Į®ĮÓĮņĮśõśśśśśśśśśśõššśśśśõšśśśśśśśgd­G£gd­G£gd­G£ņĮĀ!ĀWĀ–Ā—Ā˜ĀÆĀ°ĀĖĀÖĀāĀćĀĆCĆĆ­Ć®ĆÄÄ!Ä"ÄaıIJÄĪÄĻÄÅ"Åśśśśśśśśśśśśśśśśśõśśśššśśśśśgd­G£gd­G£gd­G£"Å^Å_ōÅČÅõÅ;ʄʅĘÉĘŹĘĖĘĢĘĶĘśśśśśśśśśņņņņ$a$gd­G£gd­G£ ,1h°Š/ °ą=!°"°# $ %°°Ä°Ä ÄÉDŠÉźyłŗĪŒ‚ŖK© Ohttp://lmobile10.blogspot.om/2010/04/reset-windows-password-tips-4-tricks.htmląÉźyłŗĪŒ‚ŖK© ¶http://lmobile10.blogspot.om/2010/04/reset-windows-password-tips-4-tricks.htmlyXō;HÆ,‚]ą'c„«†œ@@ń’@ NormalCJ_HaJmH sH tH DA@ņ’”D Default Paragraph FontRi@ó’³R  Table Normalö4Ö l4Öaö (k@ō’Į(No List8žo¢ń8 õļapple-style-span$žo¢$ õļil_ad1$žo¢$ õļil_ad2$žo¢!$ õļil_ad3$žo¢1$ õļil_ad4ˆe`Bˆ õļHTML Preformatted7 Ę2”(¼ Päx  4 Č#\'š*„.2¬5@9CJOJQJ^JaJ$žo¢Q$ õļil_ad56U@¢a6 onJ Hyperlink >*B*ph’N^`rN ­G£ Normal (Web)¤d¤d[$\$ mH sH tH Ķ¾"’’’’!ŠŃ(€Ó&€]»Üpq‹/T¦ļh“  *yÆ>ŒŃ i j — ą   a { ø ō 5 t ³ ÷ < S   š 0  Õ ?Źē)ĘS—Ł_„é,hŖĻ LsÆź2i§½¾ü8r«åbstæ\œŁlm±įDE˜ÓKL¦éź ^½źėN  Ė Ģ Ķ Ī Ļ Š Ń Ž ß C!Ź"ļ"š"ń"?##Ż#+$y$Ē$%c%±%’%M&›&é&7'…'†'Š'ū'F((Č(É(Ń(=)¼)½)į) **-*6*“*Ö*+N+‹+Č+,A,~,¹,ö,3-p-Š--æ-į-.. ..Y..°.Ķ./L/v/­/Ō/’/+0]0—0±0č01&1;1h1u1˜1³1“1ļ1,2-2 3S3T3x3”3¬3ŗ3Ć3ä3ū34!4p4æ45)5x5©5Š5Ń5ė5ģ56"6R6w6¢6Å6ļ657„7°7ē78S8•8¾8é8!9c9Œ9·9ļ9ü9#:$:Ź:Ė: ;K;‹;Œ;;Ś;Ū;ž;’;K<—<ć</={=Ē=>_>«>÷>C??Ū?'@s@æ@ AWA£AļA;BVcVˆV­V®VÆVąVįVōVõVW9WZWhWžWŻWŽWßWōWõWGXåX‡YķY+Z,Z[Z\ZœZÜZ[\[œ[Ü[\\\œ\Ü\Ż\•]@^J_ē_I`J`‡`Ē`Č`ą`ņ`ž` aaa5agaha‰aŠa£aēa+bob³b÷bųb'c?c@cdd+dNd•dĘde4eFeZe[e‰e6f˜g™gÖghhohØh©hŚhŪhii+iJikiyiÆiīiļišijj#j.j:j;jwj›j×jkkikjkykzk¹k l l&l'lglzl¶l·lål mMm“mÜmŻm!n"n#nfn–n—nĘnĒnČnoooooooooooooo*o+o¦o$pmqqÓqŌqÕq#rqrær s[s©s÷sEt“tįt/u}uĖuvgvhv²vŻv(wowŖw«w³wxžxŸxĆxļxšxyy–yøyóy0zmzŖzåz#{`{›{Ų{|R|l||”|Ć|é|ź|ļ|š|;}r}’}Æ}ų}.~X~~¶~į~ ?y“Źõ€€J€W€z€•€–€Ń€ģ5‚6‚Z‚ƒ‚Ž‚œ‚„‚Ę‚Ż‚š‚ƒRƒ”ƒéƒ „Z„‹„²„³„Ķ„Ī„ć„…4…Y…„…§…Ń…†f†’†É†ņ†5‡w‡ ‡Ė‡ˆEˆnˆ™ˆŃˆŽˆ‰‰¬‰­‰ķ‰-ŠmŠnŠoŠ¼Š½ŠąŠįŠ-‹y‹Å‹Œ]Œ©ŒõŒAŁ%ŽqŽ½Ž U”ķ9…Ń‘‘Z‘ƒ‘¹‘õ‘%’b’”’•’Ņ’““@“|“ø“¹“Ā“ī“ļ“š“”=”>”m”ū”ü”#•/•W•ƒ•µ•Ö• –>–?–¹–—…—:˜˜‚˜˜˜Å˜Ę˜į˜ā˜X™Y™•™Ā™ž™GšŸš š9›½›1œ2œyœ¾œB„ĀžHž‰žĒžŸŸPŸ|Ÿ§ŸÓŸóŸūŸüŸ' “  ” ”2”|”}”¹”ć”¢[¢™¢Ż¢$£k£“£µ£Ś£¤f¤±¤„„@„„„Ź„¦V¦W¦X¦o¦”¦¹¦Ž¦ß¦ą¦§§%§&§K§j§‹§™§Ļ§ØØØ%Ø&ØxØ©ø©Ŗ\Ŗ]ŖŒŖŖĶŖ «M««Ķ« ¬M¬¬Ķ¬ ­­Ę­q®{Æ°z°{°ø°ų°ł°±S±€±Œ±˜±™±·±é±ź± ² ²%²i²­²ń²5³y³z³©³Į³Ā³’“““­“Š“µHµˆµ¶µČµÜµŻµ ¶ø¶øøXø”ø•ø¹P¹Q¹‚¹ƒ¹­¹®¹Ó¹ņ¹ŗ!ŗWŗ–ŗ—ŗ˜ŗÆŗ°ŗĖŗÖŗāŗćŗ»C»»­»®»¼¼!¼"¼a¼±¼²¼Ī¼Ļ¼½"½^½_½½Č½õ½;¾„¾…¾É¾Ź¾Ė¾Ģ¾Ļ¾˜0€€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜ 0€€˜ 0€€˜ 0€€˜ 0€€˜ 0€€˜ 0€€˜ 0€€˜0€€˜0€€˜ 0€€˜ 0€€˜ 0€€˜ 0€€˜ 0€€˜ 0€€˜ 0€€˜ 0€€˜0€€˜0€€˜ 0€€˜ 0€€˜0€€˜ 0€€˜ 0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜ 0€€˜ 0€€˜ 0€€˜ 0€€˜ 0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜ 0 €€˜ 0 €€˜ 0 €€˜ 0 €€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜ 0 €€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜ 0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜ 0€€˜ 0€€˜ 0€€˜ 0€€˜0€€˜0€€˜0€€˜0€€˜ 0€€˜ 0€€˜0€€˜0€€˜0€€˜ 0€€˜0€€˜0€€˜0€€˜0€€˜ 0€€˜0€€˜0€€˜ 0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜ 0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€˜0€€!Ń(€Ó&€]»Üpq‹/T¦ļh“  *yÆ>ŒŃ i j — ą   a { ø ō 5 t ³ ÷ < S   š 0  Õ ?Źē)ĘS—Ł_„é,hŖĻ LsÆź2i§½¾ü8r«åbstæ\œŁlm±įDE˜ÓKL¦éź ^½źėN  Ė ĘnĒnČnooooo;¾„¾…¾É¾Ģ¾Ļ¾Ø‘0ˆ€ŖŃ00ŖŃ0ŖŃ03fL¬h¬l ¬p ¬t ¬ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ03ŖŃ0fL¬h¬l ¬p ¬t €€ŖŃ0€Ŗ‘0yz¬Źؑ0y€ؑ0y€ؑ0}€ؑ0}€ؑ0}€Ŗ‘0}€Ŗ‘0€TŹؑ0€ؑ0€ Š& #*mœĶĘdghkoqˆ‹ i0htź&C)=16S;„?—DšKėP|V©[Ž_JhNlļqMu+wŖ鄉§ą’bš?žB„ŻŖjÆʵĮ»ņĮ"ÅĶĘeijlmnprstuvwxyz{|}~€‚ƒ„…†‡‰Š‹ŒŽĶĘf!Ī‘¾ŹhmĢ&+.;Ķ¾X’€X’ŒX’ŒX’ŒX’Œ’’ō²d„‹ õ²dD‹ ö²d‹ ÷²dĊ ų²d„Š ł²d+ś²dTb ū²dœ8›ü²dÜ3›ż²d$c ž²d¼q ’²d|r ³d¼r ³d|q ³düq ³d¤³dYš³dL7’³dī—³d4} ³d”H’ ³dt’ ³dÜķ— ³d¼ś% ³dÄaŻ³dDś%³d|=“³d$D”] 2!Ń4Ń4“<“<A¬Xŗ^7`bŽdFhFh~o³ƒ³ƒ–‹–‹üŻØė®h°…²µęøķøķøĻ¾     b¦7!ļ4ļ4¹<¹<A±Xæ^<` b“dHhHhƒoуу›‹›‹āØš®m°‹²µčøļøļøĻ¾ B*€urn:schemas-microsoft-com:office:smarttags€country-region€8*€urn:schemas-microsoft-com:office:smarttags€City€:*€urn:schemas-microsoft-com:office:smarttags€Street€;*€urn:schemas-microsoft-com:office:smarttags€address€9*€urn:schemas-microsoft-com:office:smarttags€place€ ¤qĄēó)/07Ā‰˜ 9Abh¶ ¾  % 3 < ¾ Ä /0mn°±ņó56\^vw•¢¾æŻåilƒ’īō  ĶÕ$\crxśż!“ŗ#;JX [ >$D$E$L$„'Ŗ'((M(T(x({(”((ü()Ē)Ī)ė)ó)*"*P*[*^*a*ć-ń-{.~. //x//”/¤/Ö/Ū/ł/ü/00$0'0-040V0\0_0|01%1=1D1A2F2ų23£3«3®3¹3¼3Ā3ņ3ś34 44 4:4=4I4L4X4]4i4l4‰4Œ4˜4›4§4¬4ø4»4+5/5K5S5Ÿ5£5ß5ź5ś56¤6«6½6Ä6 77%7)777;7U8W8b8e8—8™8¤8§8Ą8Ā8Ķ8Š8ė8ķ8ų8ū8#9%90939e9g9r9u9Ž99›9ž9¹9»9Ę9É9ņ9õ9ž9: ::v<|<«<±<ģDļD@FCFqFzF|H‡HI$I[IeI(L*L@LALoLqL‡LˆL“L¶LĢLĶLõLłLMMMM7M;MPMQMoMvMzM|M’M“MøMŗMŠMŃMūMżMNN>N@NVNWN~N‚N—N˜N¶N¹N¼NĄNÕNÖNōNO…OˆO OÆOQQ/Q2QGQJQšQöQR!R‰RRĘRŹR.S8SŹSŠSéSėST TtT~T0U6UlUpUÓUŻUŗVĄV"W(WAWPWTXZXņXY4Z:Z[[\\D^J^V_]_ō`ü` aaæaĘaÕaŪa]b`bubxbb„b“hŗhģhļh3i9iRiaiukxk~m„mĒmÉmÓmŚm%n,n™n›nŖn­no#oĶqŅq s&s's.s‡vŒvävév/w6wZw]wvwwŽwćw©x°xĶxÕxśxy2y=y@yCyÅ|Ó|]}`}ī}÷}Z~a~ƒ~†~ø~½~Ū~Ž~ć~č~ 8>A^’€€&€#(Śé…‚‚‚›‚ž‚¤‚Ō‚Ü‚ē‚ļ‚ś‚ƒƒƒ+ƒ.ƒ:ƒ?ƒKƒNƒkƒnƒzƒ}ƒ‰ƒŽƒšƒƒ „„-„5„„…„Į„Ģ„Ü„ā„†……Ÿ…¦…ķ…ņ…† †††7‡9‡D‡G‡y‡{‡†‡‰‡¢‡¤‡Æ‡²‡Ķ‡Ļ‡Ś‡Ż‡ˆˆˆˆGˆIˆTˆWˆpˆrˆ}ˆ€ˆ›ˆˆØˆ«ˆŌˆ×ˆąˆāˆķˆšˆX‹^‹‹“‹Ī“Ń“±•“•ā•ė•˜˜°˜ŗ˜ń˜ū˜™%™5œ7œMœNœ|œ~œ”œ•œĮœĆœŁœŚœ+,DH]^|ƒ‡‰Ÿ ÅĒŻŽž ž ž!žKžMžcždž‹žž¤ž„žĆžĘžÉžĶžāžćžŸŸ’Ÿ•Ÿ­Ÿ¼Ÿ”!”<”?”T”W”!¢'¢L¢R¢ŗ¢Ą¢÷¢ū¢_£i£ū£¤¤¤9¤=¤„¤Æ¤a„g„„”„¦¦ė¦ń¦S§Y§r§§…Ø‹Ø#©2©eŖkŖB«E«B¬E¬u®{®‡ÆŽÆU±]±a±c±Ž±•±A²H²W²]²ß²ā²÷²ś²³³\¹b¹”¹—¹Ū¹į¹ś¹ ŗ¼ ¼&¾,¾o¾q¾{¾‚¾Ļ¾(+€ƒÓŚ&(€ƒ¦©ļņ“¼y~ŃŁs ‚ & 2 M P   @ L   § E G ®¶Ėā)0T^ˆŽŠÖ*,0ilƳWZ…ˆ³¶ 6;æʱ¼Ść&™CTż#8;AB»¾ÄĪŁÜćęéķÓ×āćO [   Ä Å D"L"™""#™#-$1$…%‰%š&õ&ż'(H(L((“(Ė(Ļ(Œ)Ž))“)r-‰-ī-ņ-x//Ö/Ū/00-040‚0†0e1g1ń1ö1l3r3¼3Ā3ż3444+5/5¤6«6ā6ä6ń6ų677;7Ū7ą7U8W8—8™8Ą8Ā8ė8ķ8#9%9e9g9Ž99¹9»9ņ9õ9ž9:ś;ü;Ė=Ī=E?k? @@<@B@R@c@ĖAŠAkCxC’CD6E9EqGxG2IJIZJbJŽJ‘JĘKČKÉKĢK(L*LoLqL“L¶LõLłL7M;MzM|MøMŗMūMżM>N@N~N‚N¼NĄNEOGOĢOŠOźOķOUPYPšQöQ,R6R†SSéSėSÓTŻTX“XéYėY'Z)ZČZŠZ[[H\P\—\›\Č\Š\R`U`\`_`b`f`‰`‹`ō`ü`a a aa-a3a„aĖaóaüa®b²bĘbŹb)c5cīdódg–g”g¤g«g®g±gµgŲgŚgh&h'h,h¤h¦h&j-jžj’jlkxkźkļkilqlsltl»l¾lĢlÕl$m&m™n›n?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~€‚ƒ„…†‡ˆ‰Š‹ŒŽ‘ž’’’“”•–—˜™ž’’’›œžŸ ”¢£¤„¦§Ø©Ŗ«¬­®Æ°±²³“µ¶·ø¹ŗ»¼½¾æĄĮĀĆÄÅĘĒČÉŹĖĢĶĪĻŠŃŅÓŌÕÖ×ŲŁŚŪÜŻŽßąįāćäåęēčéźėģķīļšńņóōõö÷ųłśūž’’’żž’ž’’’   ž’’’ż’’’ż’’’ż’’’ž’’’ž’’’ž’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’Root Entry’’’’’’’’ ĄFt™Ļ`Ė€Data ’’’’’’’’’’’’’1Table’’’’šģĆWordDocument’’’’."SummaryInformation(’’’’’’’’’’’’üDocumentSummaryInformation8’’’’’’’’CompObj’’’’’’’’’’’’q’’’’’’’’’’’’ž’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’’ž’ ’’’’ ĄFMicrosoft Office Word Document MSWordDocWord.Document.8ō9²q