{
  "snapshot_id": "2026-09-28-vctk",
  "created_local": "2026-09-28T18:25:00+07:00",
  "baseline_previous": "2026-09-18-vctk",
  "method": [
    "Doi chieu SHA256/MD5 file tren dia vs UpdaterState.ini hien tai + inventory baseline 18/09",
    "Fast-diff toan cay (added/removed/size-changed) vs inventory.csv - phat hien payload khong qua updater",
    "Defender audit nang quyen + custom scan ngoai vung exclusion (copy staged)",
    "Static analysis (pefile/Ghidra-ready) cho 15 binary + blob 32MB",
    "Endpoint checks thu dong (TLS/HTTP/RDAP)"
  ],
  "threats_confirmed_2026-09-28": [
    {
      "path": "_AutoKimYen/vauth.auto",
      "sha256": "ACD28D061CA9B210A2801D06C546AD0BC995A49510375A7F17D6C86449B2849B",
      "size": 6633984,
      "verdict": "Trojan:MSIL/Zusy.NK!MTB",
      "threat_id": 2147917445,
      "severity": 5,
      "appeared_local": "2026-09-19 08:40:18",
      "executed_evidence": "_AutoKimYen/AutoNapLic.log.txt 2026-09-27 06:34 (pid 35604, cua so KY-VCTK-CTCX 11.91)",
      "note": "Defender realtime cach ly moi ban sao ngoai exclusion; ban goc con trong folder duoc mien tru"
    },
    {
      "path": "_AutoVLBS/VLBS13/core.dll",
      "sha256": "B33802F9B261711EB5F63EB3C75FED81D737CCD46FCD4EB4B5934FB50C2156DE",
      "size": 112640,
      "verdict": "Trojan:Win32/tenga",
      "threat_id": 2147832057,
      "severity": 5,
      "note": "Tai xuat hien tren dia 18/09 20:07 sau khi bi cach ly cung ngay; van bi gan co khi quet lai 28/09"
    },
    {
      "path": "_TatAntiVirut/DefenderControl/DefenderControl.exe",
      "sha256": "A201F7F81277E28C0BDD680427B979AEE70E42E8A98C67F11E7C83D02F8FE7AE",
      "size": 846008,
      "verdict": "HackTool:Win32/Defendercontrol!pz",
      "threat_id": 2147890903,
      "severity": 4
    },
    {
      "path": "_TatAntiVirut/DefenderControl21/dControl.exe",
      "sha256": "1EF6C1A4DFDC39B63BFE650CA81AB89510DE6C0D3D7C608AC5BE80033E559326",
      "size": 457984,
      "verdict": "HackTool:Win32/DefenderControl!MSR",
      "threat_id": 2147754900,
      "severity": 4
    },
    {
      "path": "_AutoVLBS/VLBS19/VLBS19.zip; _AutoVLBS/VLBS19Dai/VLBS19.zip",
      "verdict": "Tool:AndroidOS/Multiverze",
      "threat_id": 304861,
      "severity": 2,
      "note": "co the false positive (da ghi nhan tu baseline 18/09)"
    }
  ],
  "changed_watch_files_sha256": {
    "AutoUpdateVCTK.exe": "F5DC940931CFB80887853B833A038BE9F3E0A49CF9AD4FEBA550951D7B0B4B80",
    "_VLAuto/VLHookPr.dll": "DB716FF77241E5F5F16C20A6C0485048EA5F3DC01D51073078D9B5AC3B0F706C",
    "_VLAuto/VLAutoPr.exe": "20F9EF68670EDFC2D55A150385872AC805E83612A1C7B8C03604D415CC7F62F7",
    "_AutoKimYen/KY_VCTK_CTCX_NEW.exe": "2C6205FBD41C305E2159A45B67ADF1D5501E5785E0BB97E2A0C724B6F6CBFFBC",
    "_AutoKimYen/vauth.auto": "ACD28D061CA9B210A2801D06C546AD0BC995A49510375A7F17D6C86449B2849B",
    "vietguards.driver": "0AC4697919C9639614E9F82E20981535466B7D0A0C5E85578009EFD8D085AE87",
    "data/s15vc_settings.pak": "DC953B9A69992ED4A83033EC4BA3D3CC864EC99D74389C538ACA228D41F71A5F",
    "_VLAuto/VLHookPr.dll.backup (goc)": "289C8C6FDDDE6F41438F66F5A3E175748EF94497F8473AF9A0229FDEC9566D15"
  },
  "vietguards_driver_versions": [
    {"sha256": "6E91D835E0E3FB4F...", "size": 30928467, "source": "zip phat hanh (Full_JxVCTK_123456.zip, mat khau 123456)"},
    {"sha256": "8AE02AE1...", "size": 32093573, "source": "snapshot 18/09"},
    {"sha256": "0AC4697919C9639614E9F82E20981535466B7D0A0C5E85578009EFD8D085AE87", "size": 32342408, "source": "hien tai 24/09"}
  ],
  "defender_state_2026-09-28": {
    "exclusion_paths": ["C:\\21AK22", "C:\\JXVCTK\\JxVoCongTruyenKy", "C:\\Users\\Windows\\Downloads\\360Auto_2.0.6.0 (khong con ton tai)"],
    "firewall_profiles_enabled": false,
    "tamper_protection": false,
    "realtime_monitoring": true,
    "signature_version": "1.459.442.0"
  },
  "new_endpoints_observed": {
    "update.vctk.me": "45.123.96.96",
    "jxvocongtruyenky.com": "222.255.115.135",
    "congthanhchienxua.com": "222.255.115.135",
    "vocongtruyenky.net": "172.237.146.39/46/18 (PARKLOGIC - do ben)",
    "kimyen.net": "103.255.237.239",
    "tadoken2.vietguards.com": "103.119.218.54"
  },
  "server_endpoints_live_2026-09-28": {
    "game_main_channel": "222.255.217.212:6673 (TCP, x6553 packets)",
    "game_secondary_channel": "222.255.217.212:6663 (TCP, x2818)",
    "gateway_login": "222.255.217.212:5622 (handshake ngan)",
    "dynamic_channel": "222.255.217.212:58899 (x77)",
    "local_udp_bind": "game64 -> 127.66.66.66:6666 (loopback, khong ra NIC)",
    "local_tcp_listener": "TrainJX -> 127.0.0.1:55344 LISTEN"
  },
  "dns_cache_anomalies": [
    "jxkeoxe.net -> 127.0.0.1 (TTL ~23h, trong khi file hosts sach)",
    "kimyen.work -> 127.0.0.1 (idem)",
    "can dieu tra: co the la chan domain cua tool khac hoac entry hosts lich su"
  ],
  "scheduled_task": {
    "name": "LaunchVCTK",
    "action": "C:\\JXVCTK\\JxVoCongTruyenKy\\AutoUpdateVCTK.exe",
    "created": "2026-09-21T06:11:30",
    "trigger": "one-shot 2026-09-21T23:59, RunLevel Highest, InteractiveToken (do DS1\\Admin tao - khong phai payload la)",
    "last_run": "2026-09-22 13:23:23, result 0"
  }
}