Thursday, October 30, 2014

BlackEnergy 2 (alias BlackEnergy Version 2) Live Debugging

Last night I took a quick look at BlackEnergy 2, a rootkit that surfaced in 2010. BlackEnergy 2 was essentially a rewrite of its predecessor as BlackEnergy 2 contains rootkit techniques, process-injection, and encryption. Surprisingly for being a now 'dated' rootkit, there's really not too much accessible (or not buried) reverse kernel-debugging documentation for the rootkit aside from when it was first surfacing. A lot of misc. information pops up throughout very few blogs/forums that are Russian, but that's about it.

There's a lot of additional lore behind the rootkit, but I really won't go into that. If you're interested about where the rootkit core came from before it was implemented into BlackEnergy 2, BlackReleaver is the answer!

NT Corruption

First off, we can view corruption regarding ntokskrnl:


 lkd> !chkimg -d -v nt  
 Searching for module with expression: nt  
 Will apply relocation fixups to file used for comparison  
 Will ignore NOP/LOCK errors  
 Will ignore patched instructions  
 Image specific ignores will be applied  
 Comparison image path: C:\Symbols\ntoskrnl.exe\41108004214780\ntoskrnl.exe  
 No range specified  

 Scanning section:  .text  
 Size: 466369  
 Range to scan: 804d7580-80549341  
   804ded5a-804ded5d 4 bytes - nt!KiBBTUnexpectedRange+8
      [ 00 ff 09 00:6b a0 c1 01 ]  
   804e59a1-804e59a5 5 bytes - nt!KeInsertQueueApc (+0x6c47)  // Not malicious -- Malwarebytes.
      [ 8b ff 55 8b ec:e9 e4 45 4e 77 ]  
 Total bytes compared: 466369(100%)  
 Number of errors: 9  

!chkimg compares the current loaded executable with the version within the symbol store. This is a helpful command to detect corruptions with images, and especially helpful when dealing with rootkits. The -d parameter displays a summary of all mismatched areas. The -v parameter makes the information verbose. In this case, the -v parameter is optional.

As noted above, we have two out-of-range values. We're interested in disassembling nt!KiBBTUnexpectedRange+8, but not nt!KeInsertQueueApc (+0x6c47). nt!KeInsertQueueApc (+0x6c47) as I commented above is in relation to the Chameleon technology from Malwarebytes. I had MWB ARK installed on this VM for testing purposes, so that is where it was spawning from.

nt!KiBBTUnexpectedRange+8 Disassembly - Healthy

If we disassemble nt!KiBBTUnexpectedRange+8 on a system not infected with BlackEnergy 2, we should expect similar results:

 lkd> u nt!KiBBTUnexpectedRange+8  
 nt!KiBBTUnexpectedRange+0x8:  
 804ded5a 00ff      add   bh,bh  
 804ded5c 0900      or   dword ptr [eax],eax  
 804ded5e 0bc0      or   eax,eax  
 804ded60 58       pop   eax  
 804ded61 5a       pop   edx  
 804ded62 8bec      mov   ebp,esp  
 804ded64 89ae34010000  mov   dword ptr [esi+134h],ebp  
 804ded6a 0f8490020000  je   nt!KiFastCallEntry+0x8d (804df000)  

nt!KiBBTUnexpectedRange+8 Disassembly - Corrupted

If we disassemble nt!KiBBTUnexpectedRange+8 on a system that has been infected with BlackEnergy 2, we should expect similar results:

 lkd> u nt!KiBBTUnexpectedRange+8  
 nt!KiBBTUnexpectedRange+0x8:  
 804ded5a 6ba0c1010bc058 imul  esp,dword ptr [eax-3FF4FE3Fh],58h  
 804ded61 5a       pop   edx  
 804ded62 8bec      mov   ebp,esp  
 804ded64 89ae34010000  mov   dword ptr [esi+134h],ebp  
 804ded6a 0f8490020000  je   nt!KiFastCallEntry+0x8d (804df000)  
 804ded70 8d15509b5580  lea   edx,[nt!KeServiceDescriptorTableShadow+0x10 (80559b50)]  
 804ded76 8b4a08     mov   ecx,dword ptr [edx+8]  
 804ded79 8b12      mov   edx,dword ptr [edx]  

So, why do we have corruptions in ntoskrnl and a corrupted nt!KiBBTUnexpectedRange+8 output? It's a side effect of the rootkit creating additional 'fake' service tables. It does this by patching the ETHREAD SystemTable pointer, which allows for things such as user threads to be patched, thread creation notification and service table pointer updating by using PsSetCreateThreadNotifyRoutine, etc.

The main use behind creating fake service tables is it gives anti-rootkit software a much harder time (harder back in 2010, at least) detecting its presence. It doesn't just 'hook' and/or modify the SSDT (which as we know would be a big red flag), it instead creates its own fake service tables, and then hooks (acquires?) the following functions:

 NtDeleteValueKey  
 NtEnumerateValueKey  
 NtEnumerateKey  
 NtOpenKey  
 NtOpenProcess  
 NtOpenThread  
 NtProtectVirtualMemory  
 NtQuerySystemInformation  
 NtReadVirtualMemory  
 NtSetContextThread  
 NtSetValueKey  
 NtSuspendThread  
 NtTerminateThread  
 NtWriteVirtualMemory
 etc...  

KTHREAD Structure
 
Given we're adding new/fake service tables, we need applications to be able to access them. This is done by using pointers as discussed above, which is accomplished in the KTHREAD Structure. Every single thread has a pointer to a ServiceTable which is ultimately set by KeInitThread. Additionally, if the thread requires GUI functions within the Shadow SSDT, PsConvertToGuiThread is called.

We can dump the KTHREAD Structure:

 lkd> dt -v nt!_KTHREAD  
 struct _KTHREAD, 73 elements, 0x1c0 bytes  
   +0x000 Header      : struct _DISPATCHER_HEADER, 6 elements, 0x10 bytes  
   +0x010 MutantListHead  : struct _LIST_ENTRY, 2 elements, 0x8 bytes  
   +0x018 InitialStack   : Ptr32 to Void  
   +0x01c StackLimit    : Ptr32 to Void  
   +0x020 Teb       : Ptr32 to Void  
   +0x0e0 ServiceTable   : Ptr32 to Void  

At this point if you'd like to see the tables, you can use the following command:

 !for_each_thread ".echo Thread: @#Thread; dt nt!_kthread ServiceTable @#Thread"   

If you see anything other than KeServiceDescriptorTable or KeServiceDescriptorTableShadow, it's a new/fake ServiceTable.

Registry Hiding

In order to survive reboots, etc, it hides its registry entry. If you're using Windows' Registry Editor, it won't find the hidden entry. For example, here's our hidden service:

 lkd> !ms_services  
 [205] | 0x01 | | qtcst | qtcst | SERVICE_RUNNING | \Driver\qtcst  

If we try and find qtcst with Registry Editor:


If we however use a 3rd party registry tool (any will probably work so long as it doesn't use Windows API calls):


We catch our culprit and the dropped driver red-handed. The driver renames after each reboot, so if you remove it and don't get the driver+registry entry at once, it'll just re-create with a different name.

Main.dll

 .exe SYS TMP cmd.exe /C b k e r n e l p l g _ d a t a getp v e r s i o n n a m e s l e e p f r e q c m d s p l u g i n s x%s_%X C:\ a d d r t y p e s e r v e r s i c m p _ a d d r b u i l d _ 
 i d str.sys \drivers\ \ \ . \ \ \ . \ G l o b a l \ %s%s { 9 D D 6 A F A 1 - 8 6 4 6 - 4 7 2 0 - 8 3 6 B - E D C B 1 0 8 5 8 6 4 A } main.dll .bdata {3D5A1694-CC2C-4ee7-A3D5-A879A9E3A623} 
 POST %.2X & = bid nt %d cn ln id ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ Content-Type: application/x-www-form-urlencoded _TEST_ .dll user32.dll advapi32.dll 
 wininet.dll ws2_32.dll DispatchCommand DispatchEvent GetLastError GetCurrentProcessId ExitThread CloseHandle KERNEL32.dll wsprintfA USER32.dll CoCreateInstance CoInitializeEx ole32.dll 
 OLEAUT32.dll WS2_32.dll RtlUnwind InterlockedExchange VirtualQuery main.dll ConfAllocGetTextByNameA ConfAllocGetTextByNameW ConfGetListNodeByName ConfGetNodeByName ConfGetNodeTextA 
 ConfGetNodeTextW ConfGetPlgNode ConfGetRootNode DownloadFile PlgSendEvent RkLoadKernelImage RkProtectObject SrvAddRequestBinaryData SrvAddRequestStringData  

Main.dll is the payload that is injected via trusted svchost. It contains as you can see a lot of readable stings, like str.sys for example. We can see str.sys in action here:


Overall, this rootkit was certainly a step up from most SSDT hooking/modification rootkits at the time. It can be a pain in the ass to remove if you don't kill everything properly : )

Thanks for reading.

References

Black Energy 2.1+
BlackEnergy Version 2 Analysis

320 comments:

  1. Replies
    1. Nice read! Always a pleasure reading! Thank you for sharing!
      Anyway, anyone heard of the project Whistler Grand in D05 in Singapore? I heard it is a pretty good project with huge potential upside. Anyone else interested? Check this out! 🇸🇬

      Whistler Grand

      Delete


  2. zapya
    zapya app
    zapya apk
    zapya download
    The transfer speed is 200 times faster than via Bluetooth.

    ReplyDelete
  3. Thanks for sharing, very informative blog.
    ReverseEngineering

    ReplyDelete
  4. Hey, this is amazing content. thank you for sharing.
    ReverseEngineering

    ReplyDelete
    Replies
    1. Nice read! Always a pleasure reading! Thank you for sharing!
      Anyway, anyone heard of the project Whistler Grand in D05 in Singapore? I heard it is a pretty good project with huge potential upside. Anyone else interested? Check this out! 🇸🇬

      Whistler Grand

      Delete
  5. Appvn has a genuinely basic, easy to understand interface. The application has a huge number of applications that are perfectly characterized. Store and in-application substance is refreshed normally

    ReplyDelete
  6. Nice read! Always a pleasure reading! Thank you for sharing!
    Anyway, anyone heard of the project Whistler Grand in D05 in Singapore? I heard it is a pretty good project with huge potential upside. Anyone else interested? Check this out! 🇸🇬

    Whistler Grand

    ReplyDelete
  7. This comment has been removed by the author.

    ReplyDelete
  8. mobdro
    mobdro apk
    mobdro app
    mobdro download
    mobdro for android
    The videos present on Mobdro can be recommended to other friends with just a tap.

    ReplyDelete
  9. Thanks for sharing this wonderful article.
    East9ja

    ReplyDelete
  10. Interesting post. I Have Been wondering about this issue, so thanks for posting.
    Pretty cool post.It ‘s really very nice and Useful post.Thanks

    Kahan Hum Kahan Tum Episode


    ReplyDelete
  11. thanks for your post i have found the information that i want on your blog its such a nice theme .
    thanks for your infomative post .
    Survivalgamingzone

    ReplyDelete
  12. Hey, thanks for sharing I always look forward to reading your posts one of the few blogs I still follow. Kasauti Zindagi Ki

    ReplyDelete
  13. I have learnt lots of things from This Website. I want to say Thanks from my core of heart.
    Naati Pinky Ki Lambi Love Story Episode

    ReplyDelete
  14. Thanks for this information, I got to learn about Apache Spark in Python. I will use this information for my service.
    Yeh Rishtey Hain Pyaar Ke

    ReplyDelete
  15. I would really appreciate it if you could also check out our work and leave some .
    Dil Jaise Dhadke Dhadakne Do
    Dadi Amma Maan Jao

    ReplyDelete
  16. I have learnt lots of things from This Website. I want to say Thanks from my core of heart.
    Kasauti Zindagi Ki episode
    https://chotisardarni.su/

    ReplyDelete
  17. Windows 10 activator is a free tool which is developed by Team Daz. It can be used to get license for Windows 10 and Microsoft Office. This is 100% safe to use and it doesn't contain any type of malicious code

    https://crackedking.com/windows-10-activator-full-loader-free-download/

    ReplyDelete
  18. I have Learned Big Lesson from you Post thanks for this Interesting post. On this Website Avilabe Colors Tv , Star plus and Zee Tv and Sony Tv All Latest Episode Uploaded You Can see here and Bookmarked this website for long time see All Episode

    https://www.kahanhumkahatum.com/category/pavitra-bhagya/

    ReplyDelete
  19. Very Much Intersting Post Watch Video of Star Plus Dramas that is hindi tv serial Sony Tv and Colors Tv and Zee Tv All Dramas are Avilable on this Website

    https://www.yehjaduhaijinnk.com/category/kasauti-zindagi-ki/

    ReplyDelete
  20. Watch here indain dramas and indain movies on Star plus and Colors Tv and Zee Tv sony Tv All darama latest episode Avilable here Bookmark us to wath more

    https://www.bepanahpeyar.com/category/yeh-jadu-hai-jinn-ka/

    ReplyDelete
  21. Adobe Photoshop CC 2020 Crack + Torrent. Adobe Photoshop CC Serial Key. Adobe Photoshop CC Crack is the most widely too used Adobe Photoshop CC Serial Key. Adobe Photoshop CC Crack: It is the world's best-known software with advanced editing tools for editing
    https://procrackch.com/adobe-photoshop-crack-activation-key/

    ReplyDelete
  22. Avast SecureLine VPN is a subscription based virtual private network service developed by Avast. It is available for Android, Microsoft Windows, macOS and iOS operating systems. SecureLine VPN encrypts the user's internet traffic and redirects the traffic
    https://owncracks.com/idm-crack-serial-key-plus-license-key-free-download/

    ReplyDelete
  23. mart Driver Updater Crack Free Download. Mirror Link. This content is locked. Please support us, use one of the buttons below With License & Serial Key[LATEST] Smart Driver Updater 5.0. 371 Crack is the first best product that automatically updates all your device drivers

    https://naveedsoft.org/smart-driver-updater-crack-download/

    ReplyDelete
  24. Internet Download Manager is a shareware download manager owned by American company Tonec, Inc. which is based in New York City. It is only available for the Microsoft Windows operating system. Internet download manager is a tool to manage and schedule downloads
    https://crackstips.com/idm-crack-6-incl-serial-number/

    ReplyDelete
  25. Thanks For your Post Watch Video of Star Plus Dramas that is Hindi tv serial Sony Tv and Colors Tv and Zee Tv All Dramas are Avilable on this Website

    https://www.yehrishteyhainpyaarkay.com/category/yeh-rishta-kya-kehlata-hai/

    ReplyDelete
  26. Searching for a Delta seat for an incredible worth, yet wouldn't fret where you sit? Essential Economy may be the correct decision for you. You'll despite everything appreciate a similar Main Cabin involvement with a lower cost, in return for fewer civilities on select flights, such as getting your seat task after check-in. Investigate the subtleties to check whether Basic Economy meets your requirements.

    Delta Economy Seats

    Delta Basic Economy

    ReplyDelete
  27. I admire this website in this is very beneficial content and really informative web page

    ReplyDelete
  28. Dirilis Ertugrul All Seasons watch Video Ertugrul Ghazi All Seasons All Episodes Watch Online Free Desi Serial, Watch Turkish Drama Series Dirilis Ertugrul Total Episodes Ptv Home In Urdu Dubbing Complete 480, 720p HD Quality. Ertugrul Ghazi All Seasons in Urdu All Episodes Download Drama 123Movies/Go Movierulz Free.

    ReplyDelete
  29. Nice Blog. Here are some good profile of educational sites.

    Boarding School in Dehradun

    ReplyDelete
  30. Very nice blog, Thanks for sharing great article.
    You are providing wonderful information, it is very useful to us.
    Keep posting like this informative articles.
    Thank you.

    From: Field Engineer
    Get to know about Database Administrator

    ReplyDelete
  31. Microsoft Toolkit is a kind of program, which is necessary to have by every person. Its primary tasks to perform are activating and deploying Microsoft Office and Windows, and managing the licensing.

    ReplyDelete
  32. AnyDesk Premium is a software for a remote connection. It stands out in the market for its speed. It provides access to computers when you are working remotely.

    ReplyDelete
  33. Call of Duty World War 2 is a video game. This game is about the circumstances and incidents of world war 2.

    ReplyDelete
  34. CLIP STUDIO PAINT EX is an advanced painting tool to make manga, comics, and illustration. This software is a versatile tool for working with every kind of graphics.

    ReplyDelete
  35. Howdy! This is my 1st comment here so I just wanted to give a
    quick shout out and tell you I truly enjoy reading through your posts.
    Can you suggest any other blogs/websites/forums that go over the same topics?
    Thanks a ton!
    adobe premiere pro crack
    ez cd audio converter crack
    itrash crack
    ntlite crack plus license key free download

    ReplyDelete
  36. After studying many pages on your site, I love your blog.
    I have added it as a book to my catalog and will see it longer.
    Please check out my website and let me know what you think.
    copy protect full crack
    wintousb-enterprise-crack-license-code

    ReplyDelete
  37. thanks for sharing such great information is benificial for me
    cleanmymac crack

    ReplyDelete
  38. It's a place where everyone can find something that interests and excites them. With the OK app, you can: – Stay in touch with your nearest and dearest
    rarevision free

    ReplyDelete
  39. Hello! This post could not be written any better! Reading this post
    reminds me of my good old room mate! He always kept talking about this.
    I will forward this page to him. Pretty sure he will have a good read.
    Thank you for sharing!
    tally erp 9 crack

    ReplyDelete
  40. Your source for fun, free mobile and PC download games. Thousands of free ... Download or play free online! ... Here is the Exact Arcade Version of Dig Dug!
    nfs payback highly compressed 100mb download

    ReplyDelete
  41. ทางเข้าเล่นsuperslothttps://superslot.game/

    ReplyDelete
  42. เล่นป็อกเด้งฟรีhttp://superslot.games

    ReplyDelete
  43. Appreciation! It shows me that I could express my appreciation for the great post.
    Amibroker crack

    ReplyDelete

  44. It is very interesting, you are an experienced blogger. I have added your feed and I hope to continue searching.
    great posts. Also, I have shared your site on social media!

    daemon tools lite serial number crack

    ReplyDelete
  45. I think this is one of the most important pieces of information.
    Mine. I am satisfied to study your article.
    But I want to comment on some common problems: the site tastes great, the articles are really great.
    anytrans
    angry birds activation key
    filebot license key
    razer surround pro crack

    ReplyDelete
  46. Have a nice day! Writing this article can't be better!
    Reading this article reminds me of my great housing partner! He has already mentioned this.
    I will send you this article, are you sure?
    You will read well Thank you very much for sharing!
    microsoft visio pro crack
    smadav crack
    beyond compare
    vmware workstation pro crack
    careueyes pro crack

    ReplyDelete
  47. I am very impressed with your post because this post is very beneficial for me and provide a new knowledge to me
    Hot Door CADtools Crack
    aSc Timetables Crack
    Origin Pro Crack

    ReplyDelete

  48. I am very impressed with your post because this post is very beneficial for me and provide a new knowledge to me
    Hot Door CADtools Crack
    aSc Timetables Crack
    Origin Pro Crack

    ReplyDelete
  49. Gilli Tv

    Watch Hindi channels star plus, Colors tv, Sony Tv, ZEe bangla, Star Jalsa, hotstar, zee5, voot, sony liv, sun nxt dramas full episodes watch online hd quality videos. Watch free online hindi language premium web series of zee 5, hotstar, voot, ALT Balaji, amazon prime or netflix i at Gilli TV.

    https://www.gillitv.net/

    ReplyDelete
  50. دانلود آهنگ های جدید پر طرفدار ایرانی شاد پاپ آهنگ پرطرفدار جدید jafar-9@

    ReplyDelete
  51. Wonderful article, thank you for sharing the info. It isn’t too often that you simply read articles where the poster understands what they’re blogging about. 토토

    ReplyDelete
  52. Right away this website will probably unquestionably usually become well known with regards to most of website customers, as a result of meticulous accounts and in addition tests. 온라인카지노

    ReplyDelete
  53. I have been looking to discover a solace or powerful method to finish this procedure and I think this is the most reasonable approach to do it viably. 파워볼게임

    ReplyDelete
  54. Right away this website will probably unquestionably usually become well known with regards to most of website customers, as a result of meticulous accounts and in addition tests. 바카라사이트

    ReplyDelete
  55. It's outstanding that you have actually uploaded an excellent post on this area. You're a male of excellent capacity. I'm attempting so tough to have this composing capacity like you. Provide me some recommendations. You'll be my instructor. 우리카지노

    ReplyDelete
  56. دانلود آهنگ عاشقانه عاشقت هستم هرچه شود از این بدتر بشود اصلی کامل معروف اینستا برای ساخت کلیپ احساسی آهنگ عاشقت هستم هرچه شود jafar-110@ علی یاسینی

    میثم ابراهیمی

    هوروش بند

    محسن ابراهیم زاده

    دانلود آهنگ مهراب چشم چشم دو ابرو

    ReplyDelete
  57. Green Villa

    latest news of entertainment,tech,finance,loan

    https://greenvilla.xyz/

    ReplyDelete
  58. Adoring your post. It is invigorating to peruse this. I trust there will be significantly all the more coming. 카지노사이트

    ReplyDelete
  59. I really enjoy reading your post about this Posting. This sort of clever work and coverage! Keep up the wonderful works guys, thanks for sharing


    adobe-photoshop-cc-crack

    ReplyDelete
  60. After looking through a few blog articles on your website,
    we sincerely appreciate the way you blogged.
    We've added it to our list of bookmarked web pages and will be checking back in the near
    future. Please also visit my website and tell us what you think.
    SpyHunter Crack
    Wondershare Recoverit Crack
    Wondershare PDFelement Pro Crack
    Proteus Crack
    PowerISO V8 Crack
    AVG PC TuneUp 2021 Crack

    ReplyDelete
  61. I'd want to express my gratitude for the time and work you put into creating this post. I'm looking for more of the same from you in the future. In truth, your inventive writing skills have inspired me to create my own BlogEngine site. Blogging, in fact, is fast extending its wings. Your article is a great illustration of it.
    N-Track Studio Suite Crack

    Quick Heal Antivirus Pro Crack

    Personal Backup Crack

    Avid Pro Tools Crack

    ReaConverter Pro Crack


    AquaSoft Stages Crack

    ReplyDelete
  62. After looking through a few blog articles on your website, we sincerely appreciate the way you blogged.
    Activatedlink
    Vuescan Crack
    Advanced Systemcare Pro Crack
    Navicat Premium Crack
    IDM Crack
    Foxit Reader Crack

    ReplyDelete
  63. CCleaner Pro Crack for Windows is a free PC optimizer that frees up space on your computer by deleting unnecessary files such as cookies, unused data, and temporary files.
    DLL Files Fixer Crack
    Wps Office Crack
    NordVPN Crack
    Mailbird Pro Crack
    Duplicate Cleaner Pro Crack

    ReplyDelete
  64. https://iamactivationcode.com/revo-uninstaller-pro-crack-serial-key-latest-version-free/

    ReplyDelete
  65. You make your presentation so easy, yet I truly think this issue is something I would not grasp.
    It appears to me too intricate and too wide.
    I look forward to your future post, I'm going to attempt to get it to hang!
    corel painter crack
    substance painter crack
    baidu antivirus crack
    5kplayer crack

    ReplyDelete
  66. Star Episodes

    Watch Hindi channels star plus, Colors tv, Sony Tv, ZEe bangla, Star Jalsa, hotstar, zee5, voot, sony liv, sun nxt dramas full episodes watch online hd quality videos. Watch free online hindi language premium web series of zee 5, hotstar, voot, ALT Balaji, amazon prime or netflix


    https://starepisodes.net/

    ReplyDelete
  67. similarly it is very hard to find Assassin's Creed 1 Torrent but you can have this game also here in just with single click only. And if you want to play the god of war 3 pc game free download full version highly compressed its is also available on this site too. So always visit here for Highly Compressed Pc Games here only one place on internet.

    ReplyDelete
  68. vst4free is a full featured, advanced, multi-threaded, multi-segment download manager and accelerator for Windows and Linux.








    ReplyDelete
  69. Hey there! Someone in my Myspace group shared this site with us so I came to look it over.

    성인야설

    ReplyDelete
  70. I’m definitely loving the information. I’m book-marking and will be tweeting this to my followers!

    오피헌터

    ReplyDelete
  71. Fantastic blog and great design and style. Good write-up, I am regular visitor of one’s website, maintain up the nice operate, and It’s going to be a regular visitor for a long time.

    건전마사지

    ReplyDelete
  72. 바카라사이트 When I originally commented I clicked the -Notify me when new comments are added- checkbox and now each time a comment is added I get four emails with the same comment. Is there any way you can remove me from that service? Thanks!

    ReplyDelete
  73. 카지노사이트 Wonderful goods from you, man. I have understand your
    stuff previous to and you’re just extremely fantastic.
    I really like what you’ve acquired here, really like what you
    are saying and the way in which you say it. You make
    it enjoyable and you still care for to keep it smart. I can not
    wait to read much more from you. This is actually a great site.

    ReplyDelete
  74. 토토사이트 I have been surfing on-line greater than three hours lately, but I never discovered any attention-grabbing article like yours.
    It's lovely price sufficient for me. Personally, if all web owners and bloggers made excellent content material as
    you did, the web will be a lot more useful than ever before.


    ReplyDelete
  75. I want to thank you for this excellent read!! I absolutely
    loved every little bit of it. I've got you book-marked to look at new stuff you
    post… 토토사이트


    ReplyDelete
  76. I am regular visitor, how are you everybody?
    This article posted at this website is in fact good
    I 송송넷

    ReplyDelete
  77. A very awesome blog post. We are really grateful for your blog post. combat, law enforcement You will find a lot of approaches after visiting your post. I was exactly searching for. Thanks for such post and please keep it up. Great work.
    고스톱

    ReplyDelete
  78. Can I simply say what relief to get somebody that in fact knows what they're dealing with on-line. You actually know how to bring a concern to light to make it essential. Workout . should ought to see this and can see this side of your story. I cant think you're less well-known simply because you definitely hold the gift.
    스포츠토토

    ReplyDelete
  79. I know this is extremely boring and you are skipping to succeeding comment, however I just needed to throw you a big thanks you cleared up some things for me!
    한국야동

    ReplyDelete
  80. It was a very good post indeed. I thoroughly enjoyed reading it in my lunch time. Will surely come and visit this blog more often. Thanks for sharing.
    토토사이트

    ReplyDelete
  81. 토토사이트 having a blog like yours would cost a pretty penny?
    I’m not very internet smart so I’m not 100% sure. Any tips or advice would be greatly appreciated.

    ReplyDelete
  82. They were active listeners and viewed meetings deadlines as an imperative. 안전놀이터

    ReplyDelete
  83. Extremely overall quite 안전사이트 fascinating post. I was searching for this sort of data and delighted in perusing this one.

    ReplyDelete
  84. The blog is instructive additionally Keep working like that!. back scratcher shoe horn 스포츠사이트

    ReplyDelete
  85. Please always write good comments 먹튀 This post is invaluable

    ReplyDelete
  86. but I believe it will help a lot in my country I'll come often. Great work! 토토사이트

    ReplyDelete
  87. After reading your article I was amazed. I know that you explain it very well. And I hope that other readers will also experience how I feel after reading your article.송송넷

    ReplyDelete
  88. This site seems to inspire me a lot. Thank you so much for organizing and providing this quality information in an easy to understand way. I think that a healthy era of big data can be maintained only when such high-quality information is continuously produced. And I, too, are working hard to organize and provide such high-quality information. It would be nice to come in once and get information.

    Also visit my site:안전토토사이트

    ReplyDelete
  89. Your ideas inspired me very much. 메이저토토사이트모음 It's amazing. I want to learn your writing skills. In fact, I also have a website. If you are okay, please visit once and leave your opinion. Thank you.

    ReplyDelete
  90. https://yourfuturetrends.blogspot.com/2014/08/windows-81-enterprise-x86-and-x64-full_10.html?showComment=1635835844349&m=1#c3141735465152193363

    ReplyDelete
  91. สล็อตแฟนตาซีเอาใจผู้เล่นสายทุนน้อย Guardians of Ice & Fire แจกหนัก จัดเต็ม คลิกที่นี่ รับโบนัส 50% ทันทีตั้งแต่ครั้งแรกที่สมัครสมาชิก เกมสล็อตผู้พิทักษ์เกมนี้มีการออกแบบเกมมาให้มีความเรียบง่าย สะดวกสบาย สามารถเข้าใช้งานได้อย่างรวดเร็ว ความพิเศษของรูปแบบเกมอยู่ตรงที่ ผู้เล่นสายทุนน้อยก็สามารถเล่นสล็อตกับเราได้ ผู้เล่นหน้าใหม่สามารถเริ่มต้นเดิมพันได้ตั้งแต่ 1 บาทเท่านั้น รวยไว เล่นง่าย เข้าถึงฟรีสปินได้แบบทันใจ สมัครสมาชิกใหม่ร่วมลงเดิมพันได้ทันที ไม่มีค่าบริการ

    ReplyDelete
  92. ambbet สมัครเล่นเกมกับเราที่นี้ ambbet

    ReplyDelete
  93. slotpg สมัครเล่นเกมกับเราที่นี้ slotpg

    ReplyDelete
  94. JOKER สมัคร เป็นเกมส์คาสิโนประเภทหนึ่ง ที่มีต้นกำเนิดมาจากคาสิโนแห่งหนึ่งในเวกัส ซึ่งคนที่คิดค้นเกมส์นี่ขึ้นมา ไม่ได้คิดมันจะเป็นเกมยอดฮิตขนาดที่นำมาทำเป็นออนไลน์ เนื่องจากมันเป็นเพียงตู้ลุ้นโชคเท่านั้น ด้วยการดึงขันโยกขึ้นลง เพื่อลุ้นรางวัลแค่นั้น แต่กลับทำให้ผู้เล่นชอบในวิธีการ ที่เล่นง่ายเพียงดึงขันโยก จนมีการผลิตตู้สล็อตออกมา แจกจ่ายไปให้กับคาสิโนทั่วโลก เป็นอะไรที่พลิกวงการเกมคาสิโนมากในอดีต จนทุกวันนี้ได้มีการพัฒนาจนสามารถเล่นผ่านอินเตอร์ได้แล้ว JOKER สมัคร https://www.joker168gaming.com/%e0%b8%aa%e0%b8%a1%e0%b8%b1%e0%b8%84%e0%b8%a3-joker/

    ReplyDelete
  95. Hello there, You have done a fantastic job. I’ll certainly digg it and individually recommend to my friends. I am sure they will be benefited from this website. Feel free to visit my website; 먹튀검증

    ReplyDelete
  96. I was able to think a lot while looking at this post. I will pass this blog to many people. Definitely a good blog is very good. Thank you for sharing. Feel free to visit my website; 바카라사이트

    ReplyDelete
  97. I want to we appreciate you this passion you cash in on throughout establishing the next few paragraphs. I am trustworthy identical best work from you when you need it at the same time. Feel free to visit my website; 바카라사이트

    ReplyDelete
  98. Very good written information. It will be valuable to anybody who employess it, as well as yours truly :). Keep up the good work – for sure i will check out more posts. Feel free to visit my website; 토토사이트

    ReplyDelete
  99. That's a really impressive new idea! 메이저토토사이트추천 It touched me a lot. I would love to hear your opinion on my site. Please come to the site I run once and leave a comment. Thank you.

    ReplyDelete
  100. This is educational content and well written for change.
    Glad to see that some people still understand how to
    write quality of online slots article reviews and good advice.

    SLOT ONLINE
    XO SLOT
    SLOT
    JOKER
    UFABET

    ReplyDelete
  101. Positive site, where did u come up with the information on this posting?I have read a few of the articles on your website now, and I really like your style. Thanks a million and please keep up the effective work. 메이저사이트

    ReplyDelete
  102. You delivered such an impressive piece to read, giving every subject enlightenment for us to gain information. Thanks for sharing such information with us due to which my several concepts have been cleared. 먹튀검증사이트

    ReplyDelete
  103. It has fully emerged to crown Singapore's southern shores and undoubtedly placed her on the global map of residential landmarks. I still scored the more points than I ever have in a season for GS. I think you would be hard pressed to find somebody with the same consistency I have had over the years so I am happy with that. 먹튀검증

    ReplyDelete
  104. get bonus fast can turn you into a new millionaire with pg game พีจีสล็อต

    ReplyDelete
  105. It's too bad to check your article late. I wonder what it would be if we met a little faster. I want to exchange a little more, but please visit my site 꽁머니 and leave a message!!


    ReplyDelete
  106. เครดิตฟรีMeet a new experience, make transactions by yourself, 24 hours a day, fast, 100% safe.

    ReplyDelete
  107. pgslot77Gamblers can win in placing bets quickly. Easy to play Slot Online. Service 24 hours a day.

    ReplyDelete
  108. autobetOnline lotteries give away free credits You will get full fun. Give away promotions, give away hard, give away for real

    ReplyDelete
  109. โปรโมชั่นNew game camp, outstanding strength Generate good income Guaranteed rich for sure

    ReplyDelete
  110. jokerslotNew online slots games that are becoming popular and hot, number 1 right now.

    ReplyDelete
  111. This comment has been removed by the author.

    ReplyDelete
  112. แจกเงินเร็ว พบกับเกมคุณภาพดีๆ ที่มีเงินรางวัลมากมายได้แล้วที่เว็บไซต์ SLOTPG เว็บไซต์ที่เต็มไปด้วยเกมคุณภาพระดับพรีเมี่ยม มีเงินรางวัลและของขวัญแจกให้จริง อีกทั้งยังไม่เคยมีประวัติการโกงอีกด้วย สนใจคลิกมาเลยที่ สล็อตฝากถอนออโต้ภายในเว็บพบกับบริการฝากถอนเงินด้วยระบบ Auto ที่มาพร้อมกับความมั่นคงและความปลอดภัยสูงสุดหนึ่งร้อยเปอร์เซ็นต์

    ReplyDelete
  113. Thanks for posting this info. I just want to let you know that I just check out your site and I find it very interesting and informative. I can't wait to read lots of your posts. สล็อตwallet

    ReplyDelete
  114. The post is written in very a good manner and it contains many useful information for me.สล็อตแตกง่าย

    ReplyDelete
  115. world-class scalp
    complete one user
    most games
    24 hours online service สล็อตเว็บตรง

    ReplyDelete
  116. I recently came across your blog and have been reading along. I thought I would leave my first comment. I don’t know what to say except that I have enjoyed reading. สล็อต Wallet

    ReplyDelete
  117. The post is written in very a good manner and it contains many useful information for me.
    สูตรสล็อต

    ReplyDelete
  118. It's very interesting. And it's fun. This is a timeless article. I also write articles related to , and I run a community related to 카지노사이트. For more information, please feel free to visit !!

    ReplyDelete
  119. You Can Also Download Free Software & mac
    https://miancrack.com/fbackup-crack/

    ReplyDelete
  120. I am a 슬롯사이트 expert. I've read a lot of articles, but I'm the first person to understand as well as you. I leave a post for the first time. It's great!!

    ReplyDelete
  121. The wireless and wired models require drivers and software; therefore, each has to undergo one important installation process. If your printer model isn’t set up yet, you can get started now.
    http //ij.start.canon,
    https //ij.start.cannon,

    ReplyDelete
  122. You can easily download the driver according to your model as ij start canon is rinter problems by which you can undoubtedly figure out how to set up from ij.start.canon and improve insight.

    ij.start.canon ,
    ij.start canon

    ReplyDelete
  123. Good morning!! I am also blogging with you. In my blog, articles related to are mainly written, and they are usually called 우리카지노. If you are curious about , please visit!!

    ReplyDelete
  124. I actually appeared to be examining a number a person's blog posts during this website plus I actually เล่นบาคาร่า think the following site is definitely rattling instructive! Keep on putting up.

    ReplyDelete
  125. While looking for articles on these topics, I came across this article on the site here. As I read your article, I felt like an expert in this field. I have several articles on these topics posted on my site. Could you please visit my homepage? 메이저놀이터순위

    ReplyDelete
  126. The post is written in very a good manner and it contains many useful information for me. สล็อต เว็บ ตรง 2022

    ReplyDelete
  127. The post is written in very a good manner and it contains many useful information for me.สล็อต แตกง่าย

    ReplyDelete
  128. The post is written in very a good manner and it contains many useful information for me.เว็บ สล็อต

    ReplyDelete