Thursday, October 30, 2014

BlackEnergy 2 (alias BlackEnergy Version 2) Live Debugging

Last night I took a quick look at BlackEnergy 2, a rootkit that surfaced in 2010. BlackEnergy 2 was essentially a rewrite of its predecessor as BlackEnergy 2 contains rootkit techniques, process-injection, and encryption. Surprisingly for being a now 'dated' rootkit, there's really not too much accessible (or not buried) reverse kernel-debugging documentation for the rootkit aside from when it was first surfacing. A lot of misc. information pops up throughout very few blogs/forums that are Russian, but that's about it.

There's a lot of additional lore behind the rootkit, but I really won't go into that. If you're interested about where the rootkit core came from before it was implemented into BlackEnergy 2, BlackReleaver is the answer!

NT Corruption

First off, we can view corruption regarding ntokskrnl:


 lkd> !chkimg -d -v nt  
 Searching for module with expression: nt  
 Will apply relocation fixups to file used for comparison  
 Will ignore NOP/LOCK errors  
 Will ignore patched instructions  
 Image specific ignores will be applied  
 Comparison image path: C:\Symbols\ntoskrnl.exe\41108004214780\ntoskrnl.exe  
 No range specified  

 Scanning section:  .text  
 Size: 466369  
 Range to scan: 804d7580-80549341  
   804ded5a-804ded5d 4 bytes - nt!KiBBTUnexpectedRange+8
      [ 00 ff 09 00:6b a0 c1 01 ]  
   804e59a1-804e59a5 5 bytes - nt!KeInsertQueueApc (+0x6c47)  // Not malicious -- Malwarebytes.
      [ 8b ff 55 8b ec:e9 e4 45 4e 77 ]  
 Total bytes compared: 466369(100%)  
 Number of errors: 9  

!chkimg compares the current loaded executable with the version within the symbol store. This is a helpful command to detect corruptions with images, and especially helpful when dealing with rootkits. The -d parameter displays a summary of all mismatched areas. The -v parameter makes the information verbose. In this case, the -v parameter is optional.

As noted above, we have two out-of-range values. We're interested in disassembling nt!KiBBTUnexpectedRange+8, but not nt!KeInsertQueueApc (+0x6c47). nt!KeInsertQueueApc (+0x6c47) as I commented above is in relation to the Chameleon technology from Malwarebytes. I had MWB ARK installed on this VM for testing purposes, so that is where it was spawning from.

nt!KiBBTUnexpectedRange+8 Disassembly - Healthy

If we disassemble nt!KiBBTUnexpectedRange+8 on a system not infected with BlackEnergy 2, we should expect similar results:

 lkd> u nt!KiBBTUnexpectedRange+8  
 nt!KiBBTUnexpectedRange+0x8:  
 804ded5a 00ff      add   bh,bh  
 804ded5c 0900      or   dword ptr [eax],eax  
 804ded5e 0bc0      or   eax,eax  
 804ded60 58       pop   eax  
 804ded61 5a       pop   edx  
 804ded62 8bec      mov   ebp,esp  
 804ded64 89ae34010000  mov   dword ptr [esi+134h],ebp  
 804ded6a 0f8490020000  je   nt!KiFastCallEntry+0x8d (804df000)  

nt!KiBBTUnexpectedRange+8 Disassembly - Corrupted

If we disassemble nt!KiBBTUnexpectedRange+8 on a system that has been infected with BlackEnergy 2, we should expect similar results:

 lkd> u nt!KiBBTUnexpectedRange+8  
 nt!KiBBTUnexpectedRange+0x8:  
 804ded5a 6ba0c1010bc058 imul  esp,dword ptr [eax-3FF4FE3Fh],58h  
 804ded61 5a       pop   edx  
 804ded62 8bec      mov   ebp,esp  
 804ded64 89ae34010000  mov   dword ptr [esi+134h],ebp  
 804ded6a 0f8490020000  je   nt!KiFastCallEntry+0x8d (804df000)  
 804ded70 8d15509b5580  lea   edx,[nt!KeServiceDescriptorTableShadow+0x10 (80559b50)]  
 804ded76 8b4a08     mov   ecx,dword ptr [edx+8]  
 804ded79 8b12      mov   edx,dword ptr [edx]  

So, why do we have corruptions in ntoskrnl and a corrupted nt!KiBBTUnexpectedRange+8 output? It's a side effect of the rootkit creating additional 'fake' service tables. It does this by patching the ETHREAD SystemTable pointer, which allows for things such as user threads to be patched, thread creation notification and service table pointer updating by using PsSetCreateThreadNotifyRoutine, etc.

The main use behind creating fake service tables is it gives anti-rootkit software a much harder time (harder back in 2010, at least) detecting its presence. It doesn't just 'hook' and/or modify the SSDT (which as we know would be a big red flag), it instead creates its own fake service tables, and then hooks (acquires?) the following functions:

 NtDeleteValueKey  
 NtEnumerateValueKey  
 NtEnumerateKey  
 NtOpenKey  
 NtOpenProcess  
 NtOpenThread  
 NtProtectVirtualMemory  
 NtQuerySystemInformation  
 NtReadVirtualMemory  
 NtSetContextThread  
 NtSetValueKey  
 NtSuspendThread  
 NtTerminateThread  
 NtWriteVirtualMemory
 etc...  

KTHREAD Structure
 
Given we're adding new/fake service tables, we need applications to be able to access them. This is done by using pointers as discussed above, which is accomplished in the KTHREAD Structure. Every single thread has a pointer to a ServiceTable which is ultimately set by KeInitThread. Additionally, if the thread requires GUI functions within the Shadow SSDT, PsConvertToGuiThread is called.

We can dump the KTHREAD Structure:

 lkd> dt -v nt!_KTHREAD  
 struct _KTHREAD, 73 elements, 0x1c0 bytes  
   +0x000 Header      : struct _DISPATCHER_HEADER, 6 elements, 0x10 bytes  
   +0x010 MutantListHead  : struct _LIST_ENTRY, 2 elements, 0x8 bytes  
   +0x018 InitialStack   : Ptr32 to Void  
   +0x01c StackLimit    : Ptr32 to Void  
   +0x020 Teb       : Ptr32 to Void  
   +0x0e0 ServiceTable   : Ptr32 to Void  

At this point if you'd like to see the tables, you can use the following command:

 !for_each_thread ".echo Thread: @#Thread; dt nt!_kthread ServiceTable @#Thread"   

If you see anything other than KeServiceDescriptorTable or KeServiceDescriptorTableShadow, it's a new/fake ServiceTable.

Registry Hiding

In order to survive reboots, etc, it hides its registry entry. If you're using Windows' Registry Editor, it won't find the hidden entry. For example, here's our hidden service:

 lkd> !ms_services  
 [205] | 0x01 | | qtcst | qtcst | SERVICE_RUNNING | \Driver\qtcst  

If we try and find qtcst with Registry Editor:


If we however use a 3rd party registry tool (any will probably work so long as it doesn't use Windows API calls):


We catch our culprit and the dropped driver red-handed. The driver renames after each reboot, so if you remove it and don't get the driver+registry entry at once, it'll just re-create with a different name.

Main.dll

 .exe SYS TMP cmd.exe /C b k e r n e l p l g _ d a t a getp v e r s i o n n a m e s l e e p f r e q c m d s p l u g i n s x%s_%X C:\ a d d r t y p e s e r v e r s i c m p _ a d d r b u i l d _ 
 i d str.sys \drivers\ \ \ . \ \ \ . \ G l o b a l \ %s%s { 9 D D 6 A F A 1 - 8 6 4 6 - 4 7 2 0 - 8 3 6 B - E D C B 1 0 8 5 8 6 4 A } main.dll .bdata {3D5A1694-CC2C-4ee7-A3D5-A879A9E3A623} 
 POST %.2X & = bid nt %d cn ln id ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ Content-Type: application/x-www-form-urlencoded _TEST_ .dll user32.dll advapi32.dll 
 wininet.dll ws2_32.dll DispatchCommand DispatchEvent GetLastError GetCurrentProcessId ExitThread CloseHandle KERNEL32.dll wsprintfA USER32.dll CoCreateInstance CoInitializeEx ole32.dll 
 OLEAUT32.dll WS2_32.dll RtlUnwind InterlockedExchange VirtualQuery main.dll ConfAllocGetTextByNameA ConfAllocGetTextByNameW ConfGetListNodeByName ConfGetNodeByName ConfGetNodeTextA 
 ConfGetNodeTextW ConfGetPlgNode ConfGetRootNode DownloadFile PlgSendEvent RkLoadKernelImage RkProtectObject SrvAddRequestBinaryData SrvAddRequestStringData  

Main.dll is the payload that is injected via trusted svchost. It contains as you can see a lot of readable stings, like str.sys for example. We can see str.sys in action here:


Overall, this rootkit was certainly a step up from most SSDT hooking/modification rootkits at the time. It can be a pain in the ass to remove if you don't kill everything properly : )

Thanks for reading.

References

Black Energy 2.1+
BlackEnergy Version 2 Analysis

209 comments:

  1. Replies
    1. Nice read! Always a pleasure reading! Thank you for sharing!
      Anyway, anyone heard of the project Whistler Grand in D05 in Singapore? I heard it is a pretty good project with huge potential upside. Anyone else interested? Check this out! 🇸🇬

      Whistler Grand

      Delete


  2. zapya
    zapya app
    zapya apk
    zapya download
    The transfer speed is 200 times faster than via Bluetooth.

    ReplyDelete
  3. Thanks for sharing, very informative blog.
    ReverseEngineering

    ReplyDelete
  4. Hey, this is amazing content. thank you for sharing.
    ReverseEngineering

    ReplyDelete
  5. Appvn has a genuinely basic, easy to understand interface. The application has a huge number of applications that are perfectly characterized. Store and in-application substance is refreshed normally

    ReplyDelete
  6. This comment has been removed by the author.

    ReplyDelete
  7. mobdro
    mobdro apk
    mobdro app
    mobdro download
    mobdro for android
    The videos present on Mobdro can be recommended to other friends with just a tap.

    ReplyDelete
  8. Interesting post. I Have Been wondering about this issue, so thanks for posting.
    Pretty cool post.It ‘s really very nice and Useful post.Thanks

    Kahan Hum Kahan Tum Episode


    ReplyDelete
  9. thanks for your post i have found the information that i want on your blog its such a nice theme .
    thanks for your infomative post .
    Survivalgamingzone

    ReplyDelete
  10. Hey, thanks for sharing I always look forward to reading your posts one of the few blogs I still follow. Kasauti Zindagi Ki

    ReplyDelete
  11. I have learnt lots of things from This Website. I want to say Thanks from my core of heart.
    Naati Pinky Ki Lambi Love Story Episode

    ReplyDelete
  12. Thanks for this information, I got to learn about Apache Spark in Python. I will use this information for my service.
    Yeh Rishtey Hain Pyaar Ke

    ReplyDelete
  13. I would really appreciate it if you could also check out our work and leave some .
    Dil Jaise Dhadke Dhadakne Do
    Dadi Amma Maan Jao

    ReplyDelete
  14. I have learnt lots of things from This Website. I want to say Thanks from my core of heart.
    Kasauti Zindagi Ki episode
    https://chotisardarni.su/

    ReplyDelete
  15. Windows 10 activator is a free tool which is developed by Team Daz. It can be used to get license for Windows 10 and Microsoft Office. This is 100% safe to use and it doesn't contain any type of malicious code

    https://crackedking.com/windows-10-activator-full-loader-free-download/

    ReplyDelete
  16. I have Learned Big Lesson from you Post thanks for this Interesting post. On this Website Avilabe Colors Tv , Star plus and Zee Tv and Sony Tv All Latest Episode Uploaded You Can see here and Bookmarked this website for long time see All Episode

    https://www.kahanhumkahatum.com/category/pavitra-bhagya/

    ReplyDelete
  17. Watch here indain dramas and indain movies on Star plus and Colors Tv and Zee Tv sony Tv All darama latest episode Avilable here Bookmark us to wath more

    https://www.bepanahpeyar.com/category/yeh-jadu-hai-jinn-ka/

    ReplyDelete
  18. Adobe Photoshop CC 2020 Crack + Torrent. Adobe Photoshop CC Serial Key. Adobe Photoshop CC Crack is the most widely too used Adobe Photoshop CC Serial Key. Adobe Photoshop CC Crack: It is the world's best-known software with advanced editing tools for editing
    https://procrackch.com/adobe-photoshop-crack-activation-key/

    ReplyDelete
  19. Internet Download Manager is a shareware download manager owned by American company Tonec, Inc. which is based in New York City. It is only available for the Microsoft Windows operating system. Internet download manager is a tool to manage and schedule downloads
    https://crackstips.com/idm-crack-6-incl-serial-number/

    ReplyDelete
  20. Thanks For your Post Watch Video of Star Plus Dramas that is Hindi tv serial Sony Tv and Colors Tv and Zee Tv All Dramas are Avilable on this Website

    https://www.yehrishteyhainpyaarkay.com/category/yeh-rishta-kya-kehlata-hai/

    ReplyDelete
  21. Searching for a Delta seat for an incredible worth, yet wouldn't fret where you sit? Essential Economy may be the correct decision for you. You'll despite everything appreciate a similar Main Cabin involvement with a lower cost, in return for fewer civilities on select flights, such as getting your seat task after check-in. Investigate the subtleties to check whether Basic Economy meets your requirements.

    Delta Economy Seats

    Delta Basic Economy

    ReplyDelete
  22. I admire this website in this is very beneficial content and really informative web page

    ReplyDelete
  23. Dirilis Ertugrul All Seasons watch Video Ertugrul Ghazi All Seasons All Episodes Watch Online Free Desi Serial, Watch Turkish Drama Series Dirilis Ertugrul Total Episodes Ptv Home In Urdu Dubbing Complete 480, 720p HD Quality. Ertugrul Ghazi All Seasons in Urdu All Episodes Download Drama 123Movies/Go Movierulz Free.

    ReplyDelete
  24. Nice Blog. Here are some good profile of educational sites.

    Boarding School in Dehradun

    ReplyDelete
  25. Very nice blog, Thanks for sharing great article.
    You are providing wonderful information, it is very useful to us.
    Keep posting like this informative articles.
    Thank you.

    From: Field Engineer
    Get to know about Database Administrator

    ReplyDelete
  26. AnyDesk Premium is a software for a remote connection. It stands out in the market for its speed. It provides access to computers when you are working remotely.

    ReplyDelete
  27. Call of Duty World War 2 is a video game. This game is about the circumstances and incidents of world war 2.

    ReplyDelete
  28. CLIP STUDIO PAINT EX is an advanced painting tool to make manga, comics, and illustration. This software is a versatile tool for working with every kind of graphics.

    ReplyDelete
  29. Howdy! This is my 1st comment here so I just wanted to give a
    quick shout out and tell you I truly enjoy reading through your posts.
    Can you suggest any other blogs/websites/forums that go over the same topics?
    Thanks a ton!
    adobe premiere pro crack
    ez cd audio converter crack
    itrash crack
    ntlite crack plus license key free download

    ReplyDelete
  30. After studying many pages on your site, I love your blog.
    I have added it as a book to my catalog and will see it longer.
    Please check out my website and let me know what you think.
    copy protect full crack
    wintousb-enterprise-crack-license-code

    ReplyDelete
  31. It's a place where everyone can find something that interests and excites them. With the OK app, you can: – Stay in touch with your nearest and dearest
    rarevision free

    ReplyDelete
  32. Hello! This post could not be written any better! Reading this post
    reminds me of my good old room mate! He always kept talking about this.
    I will forward this page to him. Pretty sure he will have a good read.
    Thank you for sharing!
    tally erp 9 crack

    ReplyDelete
  33. เล่นป็อกเด้งฟรีhttp://superslot.games

    ReplyDelete

  34. It is very interesting, you are an experienced blogger. I have added your feed and I hope to continue searching.
    great posts. Also, I have shared your site on social media!

    daemon tools lite serial number crack

    ReplyDelete
  35. I think this is one of the most important pieces of information.
    Mine. I am satisfied to study your article.
    But I want to comment on some common problems: the site tastes great, the articles are really great.
    anytrans
    angry birds activation key
    filebot license key
    razer surround pro crack

    ReplyDelete
  36. Have a nice day! Writing this article can't be better!
    Reading this article reminds me of my great housing partner! He has already mentioned this.
    I will send you this article, are you sure?
    You will read well Thank you very much for sharing!
    microsoft visio pro crack
    smadav crack
    beyond compare
    vmware workstation pro crack
    careueyes pro crack

    ReplyDelete
  37. I am very impressed with your post because this post is very beneficial for me and provide a new knowledge to me
    Hot Door CADtools Crack
    aSc Timetables Crack
    Origin Pro Crack

    ReplyDelete
  38. Gilli Tv

    Watch Hindi channels star plus, Colors tv, Sony Tv, ZEe bangla, Star Jalsa, hotstar, zee5, voot, sony liv, sun nxt dramas full episodes watch online hd quality videos. Watch free online hindi language premium web series of zee 5, hotstar, voot, ALT Balaji, amazon prime or netflix i at Gilli TV.

    https://www.gillitv.net/

    ReplyDelete
  39. I have been looking to discover a solace or powerful method to finish this procedure and I think this is the most reasonable approach to do it viably. 파워볼게임

    ReplyDelete
  40. It's outstanding that you have actually uploaded an excellent post on this area. You're a male of excellent capacity. I'm attempting so tough to have this composing capacity like you. Provide me some recommendations. You'll be my instructor. 우리카지노

    ReplyDelete
  41. دانلود آهنگ عاشقانه عاشقت هستم هرچه شود از این بدتر بشود اصلی کامل معروف اینستا برای ساخت کلیپ احساسی آهنگ عاشقت هستم هرچه شود jafar-110@ علی یاسینی

    میثم ابراهیمی

    هوروش بند

    محسن ابراهیم زاده

    دانلود آهنگ مهراب چشم چشم دو ابرو

    ReplyDelete
  42. Adoring your post. It is invigorating to peruse this. I trust there will be significantly all the more coming. 카지노사이트

    ReplyDelete
  43. I really enjoy reading your post about this Posting. This sort of clever work and coverage! Keep up the wonderful works guys, thanks for sharing


    adobe-photoshop-cc-crack

    ReplyDelete
  44. I'd want to express my gratitude for the time and work you put into creating this post. I'm looking for more of the same from you in the future. In truth, your inventive writing skills have inspired me to create my own BlogEngine site. Blogging, in fact, is fast extending its wings. Your article is a great illustration of it.
    N-Track Studio Suite Crack

    Quick Heal Antivirus Pro Crack

    Personal Backup Crack

    Avid Pro Tools Crack

    ReaConverter Pro Crack


    AquaSoft Stages Crack

    ReplyDelete
  45. After looking through a few blog articles on your website, we sincerely appreciate the way you blogged.
    Activatedlink
    Vuescan Crack
    Advanced Systemcare Pro Crack
    Navicat Premium Crack
    IDM Crack
    Foxit Reader Crack

    ReplyDelete
  46. https://iamactivationcode.com/revo-uninstaller-pro-crack-serial-key-latest-version-free/

    ReplyDelete
  47. similarly it is very hard to find Assassin's Creed 1 Torrent but you can have this game also here in just with single click only. And if you want to play the god of war 3 pc game free download full version highly compressed its is also available on this site too. So always visit here for Highly Compressed Pc Games here only one place on internet.

    ReplyDelete
  48. vst4free is a full featured, advanced, multi-threaded, multi-segment download manager and accelerator for Windows and Linux.








    ReplyDelete
  49. I’m definitely loving the information. I’m book-marking and will be tweeting this to my followers!

    오피헌터

    ReplyDelete
  50. Fantastic blog and great design and style. Good write-up, I am regular visitor of one’s website, maintain up the nice operate, and It’s going to be a regular visitor for a long time.

    건전마사지

    ReplyDelete
  51. 카지노사이트 Wonderful goods from you, man. I have understand your
    stuff previous to and you’re just extremely fantastic.
    I really like what you’ve acquired here, really like what you
    are saying and the way in which you say it. You make
    it enjoyable and you still care for to keep it smart. I can not
    wait to read much more from you. This is actually a great site.

    ReplyDelete
  52. 토토사이트 I have been surfing on-line greater than three hours lately, but I never discovered any attention-grabbing article like yours.
    It's lovely price sufficient for me. Personally, if all web owners and bloggers made excellent content material as
    you did, the web will be a lot more useful than ever before.


    ReplyDelete
  53. I want to thank you for this excellent read!! I absolutely
    loved every little bit of it. I've got you book-marked to look at new stuff you
    post… 토토사이트


    ReplyDelete
  54. I am regular visitor, how are you everybody?
    This article posted at this website is in fact good
    I 송송넷

    ReplyDelete
  55. Can I simply say what relief to get somebody that in fact knows what they're dealing with on-line. You actually know how to bring a concern to light to make it essential. Workout . should ought to see this and can see this side of your story. I cant think you're less well-known simply because you definitely hold the gift.
    스포츠토토

    ReplyDelete
  56. 토토사이트 having a blog like yours would cost a pretty penny?
    I’m not very internet smart so I’m not 100% sure. Any tips or advice would be greatly appreciated.

    ReplyDelete
  57. They were active listeners and viewed meetings deadlines as an imperative. 안전놀이터

    ReplyDelete
  58. Extremely overall quite 안전사이트 fascinating post. I was searching for this sort of data and delighted in perusing this one.

    ReplyDelete
  59. The blog is instructive additionally Keep working like that!. back scratcher shoe horn 스포츠사이트

    ReplyDelete
  60. Please always write good comments 먹튀 This post is invaluable

    ReplyDelete
  61. but I believe it will help a lot in my country I'll come often. Great work! 토토사이트

    ReplyDelete
  62. After reading your article I was amazed. I know that you explain it very well. And I hope that other readers will also experience how I feel after reading your article.송송넷

    ReplyDelete
  63. This site seems to inspire me a lot. Thank you so much for organizing and providing this quality information in an easy to understand way. I think that a healthy era of big data can be maintained only when such high-quality information is continuously produced. And I, too, are working hard to organize and provide such high-quality information. It would be nice to come in once and get information.

    Also visit my site:안전토토사이트

    ReplyDelete
  64. https://yourfuturetrends.blogspot.com/2014/08/windows-81-enterprise-x86-and-x64-full_10.html?showComment=1635835844349&m=1#c3141735465152193363

    ReplyDelete
  65. สล็อตแฟนตาซีเอาใจผู้เล่นสายทุนน้อย Guardians of Ice & Fire แจกหนัก จัดเต็ม คลิกที่นี่ รับโบนัส 50% ทันทีตั้งแต่ครั้งแรกที่สมัครสมาชิก เกมสล็อตผู้พิทักษ์เกมนี้มีการออกแบบเกมมาให้มีความเรียบง่าย สะดวกสบาย สามารถเข้าใช้งานได้อย่างรวดเร็ว ความพิเศษของรูปแบบเกมอยู่ตรงที่ ผู้เล่นสายทุนน้อยก็สามารถเล่นสล็อตกับเราได้ ผู้เล่นหน้าใหม่สามารถเริ่มต้นเดิมพันได้ตั้งแต่ 1 บาทเท่านั้น รวยไว เล่นง่าย เข้าถึงฟรีสปินได้แบบทันใจ สมัครสมาชิกใหม่ร่วมลงเดิมพันได้ทันที ไม่มีค่าบริการ

    ReplyDelete
  66. ambbet สมัครเล่นเกมกับเราที่นี้ ambbet

    ReplyDelete
  67. JOKER สมัคร เป็นเกมส์คาสิโนประเภทหนึ่ง ที่มีต้นกำเนิดมาจากคาสิโนแห่งหนึ่งในเวกัส ซึ่งคนที่คิดค้นเกมส์นี่ขึ้นมา ไม่ได้คิดมันจะเป็นเกมยอดฮิตขนาดที่นำมาทำเป็นออนไลน์ เนื่องจากมันเป็นเพียงตู้ลุ้นโชคเท่านั้น ด้วยการดึงขันโยกขึ้นลง เพื่อลุ้นรางวัลแค่นั้น แต่กลับทำให้ผู้เล่นชอบในวิธีการ ที่เล่นง่ายเพียงดึงขันโยก จนมีการผลิตตู้สล็อตออกมา แจกจ่ายไปให้กับคาสิโนทั่วโลก เป็นอะไรที่พลิกวงการเกมคาสิโนมากในอดีต จนทุกวันนี้ได้มีการพัฒนาจนสามารถเล่นผ่านอินเตอร์ได้แล้ว JOKER สมัคร https://www.joker168gaming.com/%e0%b8%aa%e0%b8%a1%e0%b8%b1%e0%b8%84%e0%b8%a3-joker/

    ReplyDelete
  68. Hello there, You have done a fantastic job. I’ll certainly digg it and individually recommend to my friends. I am sure they will be benefited from this website. Feel free to visit my website; 먹튀검증

    ReplyDelete
  69. I was able to think a lot while looking at this post. I will pass this blog to many people. Definitely a good blog is very good. Thank you for sharing. Feel free to visit my website; 바카라사이트

    ReplyDelete
  70. I want to we appreciate you this passion you cash in on throughout establishing the next few paragraphs. I am trustworthy identical best work from you when you need it at the same time. Feel free to visit my website; 바카라사이트

    ReplyDelete
  71. Very good written information. It will be valuable to anybody who employess it, as well as yours truly :). Keep up the good work – for sure i will check out more posts. Feel free to visit my website; 토토사이트

    ReplyDelete
  72. Positive site, where did u come up with the information on this posting?I have read a few of the articles on your website now, and I really like your style. Thanks a million and please keep up the effective work. 메이저사이트

    ReplyDelete
  73. You delivered such an impressive piece to read, giving every subject enlightenment for us to gain information. Thanks for sharing such information with us due to which my several concepts have been cleared. 먹튀검증사이트

    ReplyDelete
  74. It has fully emerged to crown Singapore's southern shores and undoubtedly placed her on the global map of residential landmarks. I still scored the more points than I ever have in a season for GS. I think you would be hard pressed to find somebody with the same consistency I have had over the years so I am happy with that. 먹튀검증

    ReplyDelete
  75. get bonus fast can turn you into a new millionaire with pg game พีจีสล็อต

    ReplyDelete
  76. It's too bad to check your article late. I wonder what it would be if we met a little faster. I want to exchange a little more, but please visit my site 꽁머니 and leave a message!!


    ReplyDelete
  77. เครดิตฟรีMeet a new experience, make transactions by yourself, 24 hours a day, fast, 100% safe.

    ReplyDelete
  78. pgslot77Gamblers can win in placing bets quickly. Easy to play Slot Online. Service 24 hours a day.

    ReplyDelete
  79. autobetOnline lotteries give away free credits You will get full fun. Give away promotions, give away hard, give away for real

    ReplyDelete
  80. โปรโมชั่นNew game camp, outstanding strength Generate good income Guaranteed rich for sure

    ReplyDelete
  81. jokerslotNew online slots games that are becoming popular and hot, number 1 right now.

    ReplyDelete
  82. This comment has been removed by the author.

    ReplyDelete
  83. แจกเงินเร็ว พบกับเกมคุณภาพดีๆ ที่มีเงินรางวัลมากมายได้แล้วที่เว็บไซต์ SLOTPG เว็บไซต์ที่เต็มไปด้วยเกมคุณภาพระดับพรีเมี่ยม มีเงินรางวัลและของขวัญแจกให้จริง อีกทั้งยังไม่เคยมีประวัติการโกงอีกด้วย สนใจคลิกมาเลยที่ สล็อตฝากถอนออโต้ภายในเว็บพบกับบริการฝากถอนเงินด้วยระบบ Auto ที่มาพร้อมกับความมั่นคงและความปลอดภัยสูงสุดหนึ่งร้อยเปอร์เซ็นต์

    ReplyDelete
  84. world-class scalp
    complete one user
    most games
    24 hours online service สล็อตเว็บตรง

    ReplyDelete
  85. I recently came across your blog and have been reading along. I thought I would leave my first comment. I don’t know what to say except that I have enjoyed reading. สล็อต Wallet

    ReplyDelete
  86. The post is written in very a good manner and it contains many useful information for me.
    สูตรสล็อต

    ReplyDelete
  87. You Can Also Download Free Software & mac
    https://miancrack.com/fbackup-crack/

    ReplyDelete
  88. I am a 슬롯사이트 expert. I've read a lot of articles, but I'm the first person to understand as well as you. I leave a post for the first time. It's great!!

    ReplyDelete
  89. The wireless and wired models require drivers and software; therefore, each has to undergo one important installation process. If your printer model isn’t set up yet, you can get started now.
    http //ij.start.canon,
    https //ij.start.cannon,

    ReplyDelete
  90. You can easily download the driver according to your model as ij start canon is rinter problems by which you can undoubtedly figure out how to set up from ij.start.canon and improve insight.

    ij.start.canon ,
    ij.start canon

    ReplyDelete
  91. Good morning!! I am also blogging with you. In my blog, articles related to are mainly written, and they are usually called 우리카지노. If you are curious about , please visit!!

    ReplyDelete
  92. I actually appeared to be examining a number a person's blog posts during this website plus I actually เล่นบาคาร่า think the following site is definitely rattling instructive! Keep on putting up.

    ReplyDelete
  93. While looking for articles on these topics, I came across this article on the site here. As I read your article, I felt like an expert in this field. I have several articles on these topics posted on my site. Could you please visit my homepage? 메이저놀이터순위

    ReplyDelete
  94. The post is written in very a good manner and it contains many useful information for me. สล็อต เว็บ ตรง 2022

    ReplyDelete
  95. The post is written in very a good manner and it contains many useful information for me.สล็อต แตกง่าย

    ReplyDelete
  96. The post is written in very a good manner and it contains many useful information for me.เว็บ สล็อต

    ReplyDelete
  97. This comment has been removed by the author.

    ReplyDelete
  98. This comment has been removed by the author.

    ReplyDelete
  99. The post is written in very a good manner and it contains many useful information for me. บาคาร่าวอเลท

    ReplyDelete
  100. The post is written in very a good manner and it contains many useful information for me. เกมสล็อต

    ReplyDelete
  101. The post is written in very a good manner and it contains many useful information for me. สล็อตเว็บใหญ่

    ReplyDelete
  102. The post is written in very a good manner and it contains many useful information for me. สูตร สล๊อต

    ReplyDelete
  103. I high appreciate this post. It’s hard to find the good from the bad sometimes, but I think you’ve nailed it! would you mind updating your blog with more information?.เว็บ สล็อต

    ReplyDelete
  104. The post is written in very a good manner and it contains many useful information for me. เว็บเกมสล็อต

    ReplyDelete
  105. The post is written in very a good manner and it contains many useful information for me. บา คา ร่า วอ เลท

    ReplyDelete
  106. I've been using WordPress on a number of websites for about a year and am worried about switching to another platform. I have heard good things about 토토사이트추천. Is there a way I can transfer all my wordpress content into it? Any help would be really appreciated!

    ReplyDelete
  107. I've been looking for photos and articles on this topic over the past few days due to a school assignment, 파워볼사이트 and I'm really happy to find a post with the material I was looking for! I bookmark and will come often! Thanks :D

    ReplyDelete
  108. ij.start.canon
    is the manufacturer site to download Canon printer drivers. Install and set up Canon Printer from https: //ij.start.canon and obtain high-quality printing documents straightforwardly.

    https//ij.start.cannon is actually the official site of ij start canon that helps you install the latest printer drivers and software. Visiting http //ij.start.cannon
    provides you a complete list of all canon printers where you’ve to select your printer model and download the correct setup file

    ReplyDelete
  109. The post is written in very a good manner and it contains many useful information for me.
    สล็อตแตกเยอะ

    ReplyDelete
  110. Some factors need to be in mind while choosing an inkjet printer for you. Later, you can easily set up your Canon printer through drivers from wireless connection, USB, and a few components. canon.com/ijsetup is a website to download Canon printer drivers, you can also visit canonsetup-canon.com/ijsetup website for same.

    The ij.start.cannon setup process for every Canon model is almost similar, however the download through https //ij.start.cannon or http //ij.start.cannon and installation process may differ.

    ReplyDelete
  111. AnyToISO Professional Crack allows you to convert and burn disc images to ISO files including DMG, RAR, 7Z, CDI, PDI, and others.AnyToISO Professional Crack

    ReplyDelete
  112. Nice information. I’ve bookmarked your site, and I’m adding your RSS feeds to my Google account to get updates instantly. AnyMP4 Video Converter Crack

    ReplyDelete
  113. What a wonderful article and thank you so much for sharing it with us.
    I'm a big fan of your work, and I know it helps a lot of people.https://cracksys.com/voicemod-pro-crack/

    ReplyDelete
  114. สมัคร SUPER SLOT รับโบนัสไม่อั้น พิเศษกว่าที่ไหนแน่ๆ ยิ่งไปกว่านั้นการเป็นสมาชิกกับเราก็ง่ายมาก โดยลงทะเบียนผ่านระบบอัตโนมัติ คลิกที่นี้

    ReplyDelete
  115. I high appreciate this post. It’s hard to find the good from the bad sometimes, but I think you’ve nailed it! would you mind updating your blog with more information? บาคาร่าวอเลท

    ReplyDelete
  116. watch all spanish daramas here in HD quality ·doramasvip

    ReplyDelete
  117. I was surfing the Internet for information and came across your blog. I am impressed by the information you have on this blog. It shows how well you understand this subject. สล็อตเว็บใหญ่

    ReplyDelete
  118. The post is written in very a good manner and it contains many useful information for me.เว็บ ตรง

    ReplyDelete
  119. I wanted to thank you for this excellent read!! I definitely loved every little bit of it. I have you bookmarked your site to check out the new stuff you post.สล็อต ฝาก-ถอน true wallet ไม่มี บัญชีธนาคาร

    ReplyDelete
  120. I wanted to thank you for this excellent read!! I definitely loved every little bit of it. I have you bookmarked your site to check out the new stuff you post.สล็อต ฝาก-ถอน true wallet ไม่มี บัญชีธนาคาร .

    ReplyDelete
  121. เราก็ได้มีเกมให้ทดลองเล่นแบบฟรีๆ เล่นPG หน้าเว็บ ผ่านระบบทดลองเล่น ที่มีให้คุณได้สนุกมากมายผ่านเว็บไซต์ PGSLOTGAMES กับเครดิตฟรี ที่มีให้มากกว่า 10,000 เครดิตในการเล่นสามารถนำไปใช้ในการหาเทคนิคการเล่นต่างๆ ทำรายการได้รวดเร็วตลอด 24 ชั่วโมง

    ReplyDelete
  122. พร้อมให้คุณเข้าเล่น ทางเข้าพีจี ผ่านเว็บไซต์ของคุณ เล่นได้ตลอดเวลา รับได้ตลอด 24 ชั่วโมง กับสุดยอดทีมงานมืออาชีพ หากยังไม่มียูส ดูแลในการเล่นตลอดเวลา ทุกยุค ทุกสมัย กับภาพที่สุดแสนอลังการ เล่นได้ง่าย รับโปรโมชั่นง่ายตลอด 24 ชั่วโมง

    ReplyDelete
  123. รีวิวเกมสล็อตออนไลน์จากทางค่ายเกมสล็อต mega game กับวิดิโอเกม Nugget Hunters เกมสล็อตทำเงิน 5 รีล 4 แถว ที่สามารถทำเงินรางวัลได้สูงสุดมากถึง x500 เท่า.

    ReplyDelete
  124. Very nice article. I absolutely love this website. Thanks!경마

    ReplyDelete
  125. Thank you for sharing your info. I really appreciate your efforts and I will be waiting for your next post thank you once again. 슬롯머신

    ReplyDelete
  126. Debugging And Reverse Engineering: Blackenergy 2 (Alias Blackenergy Version 2) Live Debugging >>>>> Download Now

    >>>>> Download Full

    Debugging And Reverse Engineering: Blackenergy 2 (Alias Blackenergy Version 2) Live Debugging >>>>> Download LINK

    >>>>> Download Now

    Debugging And Reverse Engineering: Blackenergy 2 (Alias Blackenergy Version 2) Live Debugging >>>>> Download Full

    >>>>> Download LINK 88

    ReplyDelete
  127. Debugging And Reverse Engineering: Blackenergy 2 (Alias Blackenergy Version 2) Live Debugging >>>>> Download Now

    >>>>> Download Full

    Debugging And Reverse Engineering: Blackenergy 2 (Alias Blackenergy Version 2) Live Debugging >>>>> Download LINK

    >>>>> Download Now

    Debugging And Reverse Engineering: Blackenergy 2 (Alias Blackenergy Version 2) Live Debugging >>>>> Download Full

    >>>>> Download LINK Dm

    ReplyDelete
  128. Its an amazing website, really enjoy your articles. Helpful and interesting too. 바카라사이트닷컴

    ReplyDelete
  129. This comment has been removed by the author.

    ReplyDelete

  130. This article is informative. thanks for sharing.
    Visit Here

    ReplyDelete
  131. Super immersive. You should also checkout https://xactivator.net/stardock-fences-crack/ which is the best free software. You will be glad about it.

    ReplyDelete
  132. WoW! nice work https://cracktrain.com/babylon-pro-ng-crack-latest/

    ReplyDelete
  133. แตกง่ายจ่ายไว
    PGSLOT

    JOKER123
    เว็บดีจนรวยเลย

    ReplyDelete
  134. https://crackedfull.org/
    This tool can keep messages in a great way. But also can save, export,
    and print the user’s iPhone messages. Through the applicationI am read your blog.
    Informative and interesting to see your blog.

    ReplyDelete
  135. สุดยอดเกมส็อตคุณภาพดีทีสุดของโลก เกมสล็อตที่จะมอบความสุขให้คุณ เป็นเกมสล็อตที่จะสามารถทำเงินให้คุณได้อย่างต่อเนื่องไม่มีหยุด นั้นก็คือเกมสล็อจของทางค่าย PG SLOT นั้นเอง หยุดที่จะไปนั่งหาเกมสล็อตเองซักที คุณจะเสียเวลาไปทำไหมกับเราหาเกมสล้อตที่ดีที่สุดนั้นก็เพราะว่า เรานี้และที่มอบสิ่งที่ดีที่สุดให้กับนักเล่นสล็อตแล้ว

    ReplyDelete
  136. This comment has been removed by the author.

    ReplyDelete
  137. What a nice post! I'm so happy to read this. 안전놀이터모음 What you wrote was very helpful to me. Thank you. Actually, I run a site similar to you. If you have time, could you visit my site? Please leave your comments after reading what I wrote. If you do so, I will actively reflect your opinion. I think it will be a great help to run my site. Have a good day.

    ReplyDelete
  138. I think This really is an enlightening post and it is rather beneficial and experienced. Hence, I would want to thank you for your endeavors that you've got built in creating this text. The many content is absolutely effectively-investigated. Many thanks...

    ReplyDelete
  139. Excellent points you wrote here..Terrific things...I think you've got manufactured some genuinely fascinating details.Keep up The nice operate.สล็อตออนไลน์

    ReplyDelete
  140. This site is actually wonderful. The knowledge listed here will surely be of some enable to me. Thanks!.สล็อตออนไลน์

    ReplyDelete
  141. Pleasant website and Unquestionably fantastic. You can do a thing much better but i however say this excellent.Keep seeking for the top.สล็อต 999

    ReplyDelete
  142. ทางเว็บไซต์อย่าง COOKIESLOT ของเราที่ให้บริการค่ายเกม PG SLOT ก็ได้มีการจัดการแข่งขันนี้ขึ้นมาเพื่อ ตามหานักเล่นสล็อตตัวจริงที่สุดของในประเทศไทย ร่วมถึงกิจกรรมนี้ก็มีคนให้ความสนใจกกันอย่างมากมากถึง 2-4 แสนคนเลยก็ว่าได้ แต่มันก็ไม่ใช่ใครก็ได้ที่จะสามารถจะมาลงสนามนี่หรือมาแข่งขันในรายการนี้ได้ง่ายๆ นั้นก็เพราะสนามนี้มีเฉพาะคนสาวกเกมสล้อตตัวจริงเท่านั้น-makam14007

    ReplyDelete
  143. Hey, I simply hopped over in your web page by means of StumbleUpon. Not one thing I might in most cases learn, however I favored your feelings none the less. Thank you for making something price reading. 메이저토토사이트

    ReplyDelete
  144. ตัวช่วยรีวิวเกมสล็อตออนไลน์ที่มีรูปแบบเวทย์มนตร์ในนิยายที่สามารถสร้างรายได้จากความสนุกเต็มประสิทธิภาพ Wizard เวทย์มนต์แห่งทองคำ สล็อตวิดีโอเกม 5 รีล 3 แถวที่สามารถชนะมากถึง x5000 เท่าของโบนัสการจ่ายเงินสูงสุดระหว่างการเล่นอย่างแน่นอน

    ReplyDelete
  145. สนุกสนานกับการท่องเที่ยวในโลกของเงินตรา ที่มาพร้อมกับเงินทองแลขอขวัญมากมายทีเว็บไซต์ สล็อตPG เว็บไว๖ที่ได้รับการยอมรับจากนักเดิมพันทุกคน มาพร้อมกัรับรองจากนานาประเทศ เว็บตรงที่หนึ่งในเมืองไทย พบกับเกมอนไลน์ระดับพรีเมียม มาพร้อมกับโปรโมชั่นสุดปังมากมายเข้ามาเล่นกันตอนนี้พบกับโปรโมชั่น New Member Bonus ฝากเงินเล่นเกมกับเราเพียงแค่ 1000 บาท รับเงินทันที 1200 บาท

    ReplyDelete
  146. เตรียมตัวรับแจ็คพอตสุดยิ่งใหญ่ไปกับเกมสุดทันสมัย สล็อตPGเว็บตรง เกมที่มีระบบการเล่นดีมากที่สุด ผู้เล่นสามารถวางเดิมพันเริ่มต้นได้เพียงแค่ 1 บาท ก็มีโอกาสรวยและได้กำไรมากถึงหลักแสน เพราะเว็บเกมสล็อตออนไลน์ของเราแจ็คพอตแตกง่ายและโบนัสแตกไวมากที่สุด เรายังมีเกมดี ๆ ให้คุณเลือกมากมาย ตามความถนัดและสไตล์คุณได้เลย รับรองว่าได้รับกำไรชัวร์ ๆ อย่างแน่นอน

    ReplyDelete
  147. Pretty nice post. I just stumbled upon your weblog and wanted to say that I have really enjoyed browsing your blog posts. After all I’ll be subscribing to your feed and I hope you write again soon 먹튀검증업체 I would like to write an article based on your article. When can I ask for a review?!

    ReplyDelete
  148. You'll want to do have a substantial capacity for establishing Remarkable information. I just like the way you believe that and one of the best ways whereby you signify your sights in the following paragraphs. I agree utilizing your tactic for pondering. Thanks for sharing.สล็อตแตกง่าย

    ReplyDelete
  149. دانلود آهنگ های جدید ایرانی شاد و غمگین گلچین معروف آهنگ جدید jafar-180@

    ReplyDelete
  150. Thank you very much for this useful article. I like it. สล็อตแตกง่าย

    ReplyDelete
  151. Something that is remarkable and should be learned. Thank you for providing this great concept. 안전놀이터

    ReplyDelete
  152. จัดเต็มทุกดอกจัดเต็มทุกเม็ดจัดเต็มทุกสปินสล็อคออนไลน์ค่ายใหญ่ยักษ์อย่างพีจีสล็อตที่สามารถพาคุณไปสนุกกับเกมใหม่ใหม่เพราะกราฟฟิคที่ทันสมัยและเกมที่อัพเดทตลอดทุกช่วงเวลาพร้อมแล้วเปิดให้บริการสำหรับคุณวันนี้ pg slot เว็บตรง

    ReplyDelete