# Static analysis - binary thay doi/moi (2026-09-28)

Sinh luc: 2026-09-28 18:05:43
Nguon: `C:\JXVCTK\JxVoCongTruyenKy` + doi chieu ban cu tu `C:\JXVCTK\Full_JxVCTK_123456.zip`

## Bang tong hop

| Target | Size | SHA256 | PE? | MaxSecEnt | RWX | Authenticode | Ghi chu |
|---|---|---|---|---|---|---|---|
| launcher_new_AutoUpdateVCTK.exe | 4057600 | `F5DC940931CFB808...` | True | 8.0 | - | False |  |
| vlhookpr_new_VLHookPr.dll | 282624 | `DB716FF77241E5F5...` | True | 6.74 | - | False |  |
| vlhookpr_backup_VLHookPr.dll.backup | 282624 | `289C8C6FDDDE6F41...` | True | 6.72 | - | False |  |
| vlautopr_new_VLAutoPr.exe | 2262528 | `20F9EF68670EDFC2...` | True | 6.56 | - | False |  |
| kymyen_new_KY_VCTK_CTCX_NEW.exe | 15775232 | `2C6205FBD41C305E...` | True | 8.0 | CO | False |  |
| kymyen_new_vauth.auto | 6633984 | `ACD28D061CA9B210...` | True | 6.75 | - | False |  |
| asi_mPK_congdongvolam.com.asi | 9374720 | `EC9A1605D4FFCA29...` | True | 8.0 | CO | False |  |
| vlbs13_core.dll | 112640 | `B33802F9B261711E...` | True | 8.0 | CO | False |  |
| winmm_VLBS19Dai.dll | 1759744 | `92858E63788EF967...` | True | 6.68 | - | False |  |
| blob_vietguards.driver | 32342408 | `0AC4697919C96396...` | None | - | - | - | KHONG phai PE (blob) |
| vietguard_VietGuardJX.sys | 212988 | `8FCF5088FFD8E0FF...` | True | 6.57 | - | False |  |
| engine_engine.dll | 402848 | `3BB7F74631C0B51C...` | True | 6.58 | CO | True |  |
| film_Game_film.exe | 2684872 | `F17D35DF0FC473D3...` | True | 6.57 | - | True |  |
| rainbow_Rainbow.dll | 28064 | `A5386F95B72319AE...` | True | 6.02 | - | True |  |
| vggame_current_vggame.exe | 3167128 | `F66DAA617E67BCF3...` | True | 8.0 | CO | True |  |

## launcher_new_AutoUpdateVCTK.exe

- Path: `C:\JXVCTK\JxVoCongTruyenKy\AutoUpdateVCTK.exe`
- Size: 4057600 | mtime: 2026-09-19 21:16:32
- SHA256: `F5DC940931CFB80887853B833A038BE9F3E0A49CF9AD4FEBA550951D7B0B4B80`
- MD5: `08B0A33A7EECEAE907BE9D8F187BA364`
- PE: machine=0x14c subsystem=2 ep=0x182f90 imagebase=0x400000 authenticode=False export=0
- Sections: .text vsz=0x1C0280 raw=0x1C0400 ent=6.49 ; .rdata vsz=0x6058E raw=0x60600 ent=5.05 ; .data vsz=0xAB60 raw=0x6200 ent=4.76 ; .fptable vsz=0x80 raw=0x200 ent=-0.00 ; .rsrc vsz=0x193038 raw=0x193200 ent=8.00 ; .reloc vsz=0x24414 raw=0x24600 ent=6.57
- Import DLLs: ADVAPI32.dll, COMCTL32.dll, GDI32.dll, IMM32.dll, KERNEL32.dll, MSIMG32.dll, Normaliz.dll, OLEACC.dll, OLEAUT32.dll, SHELL32.dll, SHLWAPI.dll, USER32.dll, UxTheme.dll, VERSION.dll, WINHTTP.dll, WINMM.dll, WINSPOOL.DRV, gdiplus.dll, ole32.dll
- Imports: WINHTTP.dll: WinHttpOpen, WinHttpReadData, WinHttpQueryHeaders, WinHttpReceiveResponse, WinHttpSendRequest, WinHttpOpenRequest, WinHttpCloseHandle, WinHttpCrackUrl, WinHttpSetOption, WinHttpConnect || ADVAPI32.dll: RegEnumKeyExW, RegEnumValueW, RegQueryValueW, RegEnumKeyW, RegSetValueExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegQueryValueExW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, CryptAcquireContextW, CryptCreateHash, CryptReleaseContext, CryptHashData, CryptGetHashParam, CryptDestroyHash, RegOpenKeyExW, RegCloseKey || SHELL32.dll: ShellExecuteW, Shell_NotifyIconW, SHGetFolderPathW, CommandLineToArgvW, SHBrowseForFolderW, DragFinish, DragQueryFileW, SHAppBarMessage, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteExW || ole32.dll: OleDuplicateData, ReleaseStgMedium, CoTaskMemFree, CoTaskMemAlloc, CoCreateGuid, CoDisconnectObject, DoDragDrop, OleGetClipboard, CoLockObjectExternal, RegisterDragDrop, RevokeDragDrop, OleLockRunning, OleCreateMenuDescriptor, OleDestroyMenuDescriptor, OleTranslateAccelerator, IsAccelerator, CoInitializeEx, CreateStreamOnHGlobal, CoUninitialize, CoInitialize, CoCreateInstance || OLEAUT32.dll: VarBstrFromDate, VariantCopy, VariantTimeToSystemTime, SysAllocString, VariantInit, SysFreeString, SysStringLen, SysAllocStringLen, LoadTypeLib, VariantChangeType, VariantClear, SystemTimeToVariantTime || VERSION.dll: VerQueryValueW, GetFileVersionInfoW, GetFileVersionInfoSizeW || gdiplus.dll: GdipGetImageWidth, GdipGetImageHeight, GdipCreateBitmapFromFile, GdipLoadImageFromStream, GdipLoadImageFromFile, GdipBitmapGetPixel, GdipCreateFromHDC, GdipDeleteGraphics, GdipSetInterpolationMode, GdipSetPixelOffsetMode, GdipDrawImageRectI, GdiplusShutdown, GdipDrawImageRectRectI, GdipCreateBitmapFromStream, GdipCloneImage, GdipAlloc, GdipDisposeImage, GdiplusStartup, GdipFree, GdipCreateBitmapFromHBITMAP, GdipDrawImageI, GdipBitmapUnlockBits, GdipBitmapLockBits, GdipGetImageGraphicsContext, GdipGetImagePixelFormat, GdipGetImagePalette, GdipGetImagePaletteSize, GdipCreateBitmapFromScan0 || Normaliz.dll: NormalizeString || KERNEL32.dll: GlobalHandle, LocalAlloc, LocalReAlloc, GetLocaleInfoW, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, GlobalFlags, GlobalGetAtomNameW, FileTimeToSystemTime, lstrcpyW, FlushFileBuffers, GetFileSize, GetVolumeInformationW, LockFile, SetEndOfFile, SetFilePointer, UnlockFile, DuplicateHandle, GetCurrentProcess, lstrcmpiW, VerSetConditionMask, VerifyVersionInfoW, VirtualProtect, SetErrorMode, FileTimeToLocalFileTime, GetFileTime, InitializeCriticalSection, SystemTimeToTzSpecificLocalTime, GetWindowsDirectoryW, SearchPathW || USER32.dll: WaitMessage, PostThreadMessageW, FrameRect, CopyIcon, SetCursorPos, ReuseDDElParam, UnpackDDElParam, InsertMenuItemW, TranslateAcceleratorW, BringWindowToTop, CopyAcceleratorTableW, DestroyAcceleratorTable, CreateAcceleratorTableW, LoadAcceleratorsW, MapVirtualKeyW, GetKeyboardState, GetKeyboard
- URL (0): khong
- IP (0): khong
- Keyword hits: {'http': 18, 'winhttp': 11, 'https://': 4, 'http://': 3, 'loadlibrary': 3, 'shellexecute': 2, 'startup': 2, 'vctk.me': 2, 'setwindowshookex': 1, 'getasynckeystate': 1, 'createprocess': 1, 'getprocaddress': 1, 'vietguards': 1, 'kimyen': 1}
- Full strings: `launcher_new_AutoUpdateVCTK.exe.strings.txt`

## vlhookpr_new_VLHookPr.dll

- Path: `C:\JXVCTK\JxVoCongTruyenKy\_VLAuto\VLHookPr.dll`
- Size: 282624 | mtime: 2026-09-25 22:59:05
- SHA256: `DB716FF77241E5F5F16C20A6C0485048EA5F3DC01D51073078D9B5AC3B0F706C`
- MD5: `A29D429C9CE1BF535E15EC8DD08121F6`
- PE: machine=0x14c subsystem=2 ep=0x1759e imagebase=0x10000000 authenticode=False export=2
- Sections: .text vsz=0x34D76 raw=0x34E00 ent=6.63 ; .rdata vsz=0xBDBA raw=0xBE00 ent=5.58 ; .data vsz=0x2F088 raw=0xE00 ent=2.91 ; .fptable vsz=0x80 raw=0x200 ent=-0.00 ; .rsrc vsz=0x1E0 raw=0x200 ent=4.72 ; .reloc vsz=0x2D74 raw=0x2E00 ent=6.74
- Import DLLs: KERNEL32.dll
- Imports: KERNEL32.dll: CloseHandle, OpenProcess, ReadProcessMemory, DisableThreadLibraryCalls, FreeLibrary, GetModuleFileNameA, LoadLibraryA, ReadFile, GlobalAlloc, GetProcAddress, GetPrivateProfileIntA, GetPrivateProfileStringA, HeapAlloc, HeapFree, GetProcessHeap, GetCurrentProcessId, GlobalUnlock, GlobalLock, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, SetEvent, ResetEvent, WaitForSingleObjectEx
- URL (0): khong
- IP (0): khong
- Keyword hits: {'setwindowshookex': 2, 'loadlibrary': 2, 'readprocessmemory': 1, 'getasynckeystate': 1, 'getprocaddress': 1, 'startup': 1}
- Full strings: `vlhookpr_new_VLHookPr.dll.strings.txt`

## vlhookpr_backup_VLHookPr.dll.backup

- Path: `C:\JXVCTK\JxVoCongTruyenKy\_VLAuto\VLHookPr.dll.backup`
- Size: 282624 | mtime: 2026-09-10 00:23:10
- SHA256: `289C8C6FDDDE6F41438F66F5A3E175748EF94497F8473AF9A0229FDEC9566D15`
- MD5: `1F7D059401E48979CCA0B0D50FF00829`
- PE: machine=0x14c subsystem=2 ep=0x1742e imagebase=0x10000000 authenticode=False export=2
- Sections: .text vsz=0x34C06 raw=0x34E00 ent=6.62 ; .rdata vsz=0xBD92 raw=0xBE00 ent=5.57 ; .data vsz=0x2F088 raw=0xE00 ent=2.91 ; .fptable vsz=0x80 raw=0x200 ent=-0.00 ; .rsrc vsz=0x1E0 raw=0x200 ent=4.72 ; .reloc vsz=0x2D58 raw=0x2E00 ent=6.72
- Import DLLs: KERNEL32.dll
- Imports: KERNEL32.dll: CloseHandle, OpenProcess, ReadProcessMemory, DisableThreadLibraryCalls, FreeLibrary, GetModuleFileNameA, LoadLibraryA, ReadFile, GlobalAlloc, GetProcAddress, GetModuleHandleA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, GlobalLock, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, SetEvent, ResetEvent, WaitForSingleObjectEx, CreateEventW, GetModuleHandleW, IsDebuggerPresent
- URL (0): khong
- IP (0): khong
- Keyword hits: {'setwindowshookex': 2, 'loadlibrary': 2, 'readprocessmemory': 1, 'getasynckeystate': 1, 'getprocaddress': 1, 'startup': 1}
- Full strings: `vlhookpr_backup_VLHookPr.dll.backup.strings.txt`

## vlautopr_new_VLAutoPr.exe

- Path: `C:\JXVCTK\JxVoCongTruyenKy\_VLAuto\VLAutoPr.exe`
- Size: 2262528 | mtime: 2026-09-25 22:59:07
- SHA256: `20F9EF68670EDFC2D55A150385872AC805E83612A1C7B8C03604D415CC7F62F7`
- MD5: `DF17E44FC5C254AE0A0985C3A2154C8E`
- PE: machine=0x14c subsystem=2 ep=0x15b1ce imagebase=0x400000 authenticode=False export=0
- Sections: .text vsz=0x18DBFC raw=0x18DC00 ent=6.43 ; .rdata vsz=0x5C352 raw=0x5C400 ent=5.04 ; .data vsz=0xD1F8 raw=0x6200 ent=4.67 ; .fptable vsz=0x80 raw=0x200 ent=-0.00 ; .rsrc vsz=0x12CD8 raw=0x12E00 ent=5.77 ; .reloc vsz=0x24FE8 raw=0x25000 ent=6.56
- Import DLLs: ADVAPI32.dll, COMCTL32.dll, GDI32.dll, IMM32.dll, KERNEL32.dll, MSIMG32.dll, OLEACC.dll, OLEAUT32.dll, PSAPI.DLL, SHELL32.dll, SHLWAPI.dll, USER32.dll, UxTheme.dll, VLHookPr.dll, WINMM.dll, WINSPOOL.DRV, WS2_32.dll, gdiplus.dll, ole32.dll, oledlg.dll
- Imports: VLHookPr.dll: ?StopInject@@YAIPAUHWND__@@@Z, ?StartInject@@YAIPAUHWND__@@0@Z || WINMM.dll: PlaySoundW || KERNEL32.dll: FlsGetValue, FlsAlloc, GetTimeZoneInformation, ExitProcess, GetStdHandle, GetFileType, SetStdHandle, QueryPerformanceFrequency, HeapQueryInformation, GetCommandLineW, FlsFree, FreeLibraryAndExitThread, ExitThread, CreateThread, VirtualQuery, VirtualAlloc, GetSystemInfo, RtlUnwind, OutputDebugStringW, FlsSetValue, InitializeCriticalSectionEx, GetCommandLineA, LCMapStringW, GetConsoleOutputCP, GetConsoleMode, ReadConsoleW, SetFilePointerEx, FindFirstFileExW, FindNextFileW, IsValidCodePage || USER32.dll: IntersectRect, RealChildWindowFromPoint, CopyImage, GetSysColorBrush, CharNextW, GetAsyncKeyState, WindowFromPoint, GetDesktopWindow, GetNextDlgTabItem, EndDialog, CreateDialogIndirectParamW, OffsetRect, SetRectEmpty, SendDlgItemMessageA, SystemParametersInfoW, InflateRect, GetMenuItemInfoW, DestroyMenu, ClientToScreen, GetWindowDC, TabbedTextOutW, GrayStringW, DrawTextExW, DrawTextW, MapDialogRect, SetWindowContextHelpId, ShowOwnedPopups, PostQuitMessage, GetActiveWindow, TranslateMessage || GDI32.dll: ExcludeClipRect, GetClipBox, GetObjectType, GetPixel, GetViewportExtEx, GetWindowExtEx, IntersectClipRect, LineTo, PtVisible, RectVisible, RestoreDC, SaveDC, SelectClipRgn, ExtSelectClipRgn, SelectObject, SelectPalette, SetBkMode, SetMapMode, SetLayout, GetLayout, SetPolyFillMode, SetROP2, SetTextAlign, MoveToEx, TextOutW, ExtTextOutW, SetViewportExtEx, SetViewportOrgEx, SetWindowExtEx, SetWindowOrgEx || MSIMG32.dll: AlphaBlend, TransparentBlt || WINSPOOL.DRV: ClosePrinter, OpenPrinterW, DocumentPropertiesW || ADVAPI32.dll: RegDeleteValueW, AdjustTokenPrivileges, LookupPrivilegeValueW, RegEnumKeyExW, RegEnumValueW, RegQueryValueW, RegEnumKeyW, RegSetValueExW, OpenProcessToken, RegDeleteKeyW, RegCreateKeyExW, RegQueryValueExW, RegOpenKeyExW, RegCloseKey || SHELL32.dll: Shell_NotifyIconW, SHGetFileInfoW, DragQueryFileW, DragFinish, SHGetPathFromIDListW, SHGetSpecialFolderLocation, SHAppBarMessage, SHBrowseForFolderW, SHGetDesktopFolder, ShellExecuteW || COMCTL32.dll: ImageList_AddMasked, InitCommonControlsEx || SHLWAPI.dll: PathFindExtensionW, PathIsUNCW, PathRemoveFileSpecW, StrFormatKBSizeW, PathFindFileNameW, PathStripToRootW || UxTheme.dll: IsAppThemed, GetThemePartSize, IsThemeBackgroundPartiallyTransparent, GetCurrentThemeName, GetWindowTheme, DrawThemeBackground, CloseThemeData, OpenThemeData, DrawThemeParentBackground, DrawThemeText, GetThemeColor, GetThemeSysColor || ole32.dll: OleCreateMenuDescriptor, OleDestroyMenuDescriptor, OleTranslateAccelerator, IsAccelerator, OleLockRunning, RevokeDragDrop, RegisterDragDrop, CoLockObjectExternal, OleGetClipboard, DoDragDrop, CoRegisterMessageFilter, OleIsCurrentClipboard, OleFlushClipboard, CoRevokeClassObject, CreateStreamOnHGlobal, OleUninitialize, OleInitialize, CoFreeUnusedLibraries, CreateILockBytesOnHGlobal, StgOpenStorageOnILockBytes, StgCreateDocfileOnILockBytes, CoGetClassObje
- URL (0): khong
- IP (0): khong
- Keyword hits: {'loadlibrary': 3, 'startup': 2, 'http://': 1, 'readprocessmemory': 1, 'setwindowshookex': 1, 'getasynckeystate': 1, 'shellexecute': 1, 'getprocaddress': 1, 'http': 1}
- Full strings: `vlautopr_new_VLAutoPr.exe.strings.txt`

## kymyen_new_KY_VCTK_CTCX_NEW.exe

- Path: `C:\JXVCTK\JxVoCongTruyenKy\_AutoKimYen\KY_VCTK_CTCX_NEW.exe`
- Size: 15775232 | mtime: 2026-09-20 18:32:55
- SHA256: `2C6205FBD41C305E2159A45B67ADF1D5501E5785E0BB97E2A0C724B6F6CBFFBC`
- MD5: `EA9374035CEC11189691D2B02B2058D7`
- PE: machine=0x14c subsystem=2 ep=0xefd51c imagebase=0x400000 authenticode=False export=0
- Sections: (empty) vsz=0xD000 raw=0x7A00 ent=7.99 RWX! ; (empty) vsz=0x6000 raw=0x2400 ent=7.89 RWX! ; (empty) vsz=0x2000 raw=0x200 ent=6.27 RWX! ; (empty) vsz=0x2000 raw=0x200 ent=3.97 RWX! ; (empty) vsz=0x1000 raw=0xE00 ent=7.92 RWX! ; (empty) vsz=0x513000 raw=0x402000 ent=8.00 RWX! ; .rsrc vsz=0x2000 raw=0x2000 ent=3.64 ; (empty) vsz=0x7B7000 raw=0x8E0E00 ent=8.00 RWX! ; .data vsz=0x21C000 raw=0x21B400 ent=7.96 RWX!
- Import DLLs: advapi32.dll, gdi32.dll, kernel32.dll, oleaut32.dll, shell32.dll, user32.dll, version.dll
- Imports: kernel32.dll: GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA || user32.dll: MessageBoxA || advapi32.dll: RegCloseKey || oleaut32.dll: SysFreeString || gdi32.dll: CreateFontA || shell32.dll: ShellExecuteA || version.dll: GetFileVersionInfoA
- URL (1): ['http://pki-ocsp.symauth.com0']
- IP (0): khong
- Keyword hits: {'http://': 3, 'http': 3, 'shellexecute': 1, 'loadlibrary': 1, 'getprocaddress': 1, 'vlbs': 1}
- Full strings: `kymyen_new_KY_VCTK_CTCX_NEW.exe.strings.txt`

## kymyen_new_vauth.auto

- Path: `C:\JXVCTK\JxVoCongTruyenKy\_AutoKimYen\vauth.auto`
- Size: 6633984 | mtime: 2026-09-19 08:40:18
- SHA256: `ACD28D061CA9B210A2801D06C546AD0BC995A49510375A7F17D6C86449B2849B`
- MD5: `CD3151230F31824FDD74741FB298041E`
- PE: machine=0x14c subsystem=2 ep=0x65455e imagebase=0x400000 authenticode=False export=0
- Sections: .text vsz=0x652564 raw=0x652600 ent=6.75 ; .rsrc vsz=0xF50 raw=0x1000 ent=3.34 ; .reloc vsz=0xC raw=0x200 ent=0.10
- Import DLLs: mscoree.dll
- Imports: mscoree.dll: _CorExeMain
- URL (0): khong
- IP (3): ['10.0.0.0', '2.0.2.4', '4.0.0.0']
- Keyword hits: {'http': 2, 'writeprocessmemory': 1, 'readprocessmemory': 1, 'createremotethread': 1, 'setwindowshookex': 1, 'sendinput': 1, 'shellexecute': 1, 'createprocess': 1, 'getprocaddress': 1}
- Full strings: `kymyen_new_vauth.auto.strings.txt`

## asi_mPK_congdongvolam.com.asi

- Path: `C:\JXVCTK\JxVoCongTruyenKy\_AutoVLBS\VLBS19Dai\mPK_congdongvolam.com.asi`
- Size: 9374720 | mtime: 2026-09-10 00:23:10
- SHA256: `EC9A1605D4FFCA2950410A33DC3C5697D3668AAD6376ABB9AA1BF182435B526E`
- MD5: `71454C678ADBAC5417FA60815A4CC88A`
- PE: machine=0x14c subsystem=2 ep=0x1b2a7a8 imagebase=0x10000000 authenticode=False export=844
- Sections: (empty) vsz=0xC54000 raw=0x55AA00 ent=8.00 RWX! ; (empty) vsz=0x586000 raw=0x13FC00 ent=8.00 RWX! ; (empty) vsz=0x47000 raw=0x5800 ent=7.99 RWX! ; (empty) vsz=0x5B000 raw=0x35400 ent=8.00 RWX! ; (empty) vsz=0x695000 raw=0xA00 ent=7.47 RWX! ; .data vsz=0x21B000 raw=0x21AC00 ent=7.96 RWX!
- Import DLLs: CRYPT32.dll, DNSAPI.dll, IPHLPAPI.DLL, PSAPI.DLL, SHLWAPI.dll, WINMM.dll, WS2_32.dll, advapi32.dll, bcrypt.dll, gdi32.dll, kernel32.dll, ole32.dll, oleaut32.dll, shell32.dll, user32.dll, version.dll
- Imports: kernel32.dll: GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA || user32.dll: MessageBoxA || advapi32.dll: RegCloseKey || oleaut32.dll: SysFreeString || gdi32.dll: CreateFontA || shell32.dll: ShellExecuteA || version.dll: GetFileVersionInfoA || SHLWAPI.dll: StrRetToStrW || DNSAPI.dll: DnsFree || IPHLPAPI.DLL: GetBestInterfaceEx || WS2_32.dll: freeaddrinfo || CRYPT32.dll: CertCloseStore || PSAPI.DLL: EnumProcessModules || ole32.dll: CoTaskMemFree || bcrypt.dll: BCryptGenRandom || WINMM.dll: timeGetTime
- URL (1): ['http://pki-ocsp.symauth.com0']
- IP (0): khong
- Keyword hits: {'http://': 3, 'http': 3, 'shellexecute': 1, 'loadlibrary': 1, 'getprocaddress': 1}
- Full strings: `asi_mPK_congdongvolam.com.asi.strings.txt`

## vlbs13_core.dll

- Path: `C:\JXVCTK\JxVoCongTruyenKy\_AutoVLBS\VLBS13\core.dll`
- Size: 112640 | mtime: 2026-09-18 20:07:52
- SHA256: `B33802F9B261711EB5F63EB3C75FED81D737CCD46FCD4EB4B5934FB50C2156DE`
- MD5: `94A95FE6E16A3C4F140CD50C9E5E77E3`
- PE: machine=0x14c subsystem=2 ep=0x9e329 imagebase=0x10000000 authenticode=False export=3
- Sections: .text vsz=0x9D000 raw=0x1A000 ent=8.00 RWX! ; .rsrc vsz=0x2000 raw=0x1200 ent=7.13 RWX! ; .reloc vsz=0x200 raw=0x200 ent=0.18
- Import DLLs: USER32.dll, kernel32.dll
- Imports: kernel32.dll: LoadLibraryA, GetProcAddress, VirtualAlloc, VirtualFree || USER32.dll: GetWindowRect
- URL (0): khong
- IP (0): khong
- Keyword hits: {'loadlibrary': 1, 'getprocaddress': 1}
- Full strings: `vlbs13_core.dll.strings.txt`

## winmm_VLBS19Dai.dll

- Path: `C:\JXVCTK\JxVoCongTruyenKy\_AutoVLBS\VLBS19Dai\winmm.dll`
- Size: 1759744 | mtime: 2026-09-10 00:23:04
- SHA256: `92858E63788EF967961D7A41EE1A3051E845657A181430A00FD68D9DB6942B7C`
- MD5: `1931075B59D02ADAF01C829C086D5426`
- PE: machine=0x14c subsystem=2 ep=0x463d9 imagebase=0x10000000 authenticode=False export=1308
- Sections: .text vsz=0x7A26C raw=0x7A400 ent=6.55 ; .rdata vsz=0x2D352 raw=0x2D400 ent=5.29 ; .data vsz=0x941AC raw=0x2000 ent=3.96 ; .fptable vsz=0x80 raw=0x200 ent=-0.00 ; .rsrc vsz=0xFCAD0 raw=0xFCC00 ent=6.67 ; .reloc vsz=0x6FA8 raw=0x7000 ent=6.68
- Import DLLs: GDI32.dll, KERNEL32.dll, SHELL32.dll, USER32.dll, WS2_32.dll, d3d9.dll, dbghelp.dll, ole32.dll
- Imports: KERNEL32.dll: HeapFree, GetProcessHeap, GetNativeSystemInfo, VirtualAlloc, VirtualProtect, VirtualFree, FreeLibrary, GetProcAddress, LoadLibraryA, IsBadReadPtr, LoadLibraryW, VirtualQuery, CloseHandle, GetLastError, HeapCreate, HeapReAlloc, Sleep, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, OpenThread, SuspendThread, ResumeThread, GetThreadContext, SetThreadContext, FlushInstructionCache, GetModuleHandleW, CreateToolhelp32Snapshot, Thread32First, Thread32Next || USER32.dll: GetDlgItemTextW, SetWindowTextW, GetWindowRect, GetDesktopWindow, EnumWindows, GetWindowThreadProcessId, SetDlgItemTextW, EndDialog, DialogBoxParamW, SetWindowsHookExW, FindWindowW, ShowCursor, SetForegroundWindow, KillTimer, SetTimer, SendMessageW, ReleaseDC, GetDC, MessageBoxW, CallNextHookEx, wsprintfW, SetWindowPos || GDI32.dll: GetDeviceCaps || SHELL32.dll: SHGetKnownFolderPath, ShellExecuteW || ole32.dll: CoTaskMemFree, CoCreateInstance || d3d9.dll: Direct3DCreate9 || dbghelp.dll: SymFromAddr, MiniDumpWriteDump, SymCleanup, SymSetOptions, StackWalk64, SymInitialize || WS2_32.dll: inet_ntoa, inet_addr, htons, htonl, getsockopt, ntohl, getpeername, ioctlsocket, connect, closesocket, bind, accept, ntohs, recv, recvfrom, select, send, sendto, setsockopt, shutdown, socket, WSAStartup, WSACleanup, WSASetLastError, WSAGetLastError, WSACloseEvent, WSACreateEvent, listen, WSAEventSelect, WSAGetOverlappedResult
- URL (0): khong
- IP (0): khong
- Keyword hits: {'http': 212, 'winhttp': 156, 'loadlibrary': 15, 'startup': 12, 'internetopen': 8, 'setwindowshookex': 5, 'createprocess': 5, 'getprocaddress': 4, 'cookies': 2, 'getasynckeystate': 2, 'minidump': 1, 'writeprocessmemory': 1, 'readprocessmemory': 1, 'createremotethread': 1, 'virtualprotectex': 1, 'shellexecute': 1}
- Full strings: `winmm_VLBS19Dai.dll.strings.txt`

## blob_vietguards.driver

- Path: `C:\JXVCTK\JxVoCongTruyenKy\vietguards.driver`
- Size: 32342408 | mtime: 2026-09-24 20:23:32
- SHA256: `0AC4697919C9639614E9F82E20981535466B7D0A0C5E85578009EFD8D085AE87`
- MD5: `C4F7915C33E0B73F79D01AF71FADE93D`
- BLOB per-MB entropy: [7.957, 7.918, 8.0, 7.999, 7.999, 7.999, 7.999, 7.999, 8.0, 8.0, 8.0, 7.982, 7.951, 7.955, 7.955, 7.977, 7.983, 7.963, 7.969, 7.924, 7.925, 7.966, 7.963, 7.965, 7.996, 8.0, 8.0, 8.0, 8.0, 8.0, 7.999]
- BLOB embedded PE offsets: khong co
- BLOB first bytes: `7f 6f 8b c0 fd 97 fd a4 97 3f cb 0b 74 7e 41 7d f4 d5 27 31 aa fa 9d 05 ee 56 50 d2 a2 e8 d6 16`
- URL (0): khong
- IP (0): khong
- Keyword hits: {'vlbs': 1}
- Full strings: `blob_vietguards.driver.strings.txt`

## vietguard_VietGuardJX.sys

- Path: `C:\JXVCTK\JxVoCongTruyenKy\VietGuardJX.sys`
- Size: 212988 | mtime: 2026-08-17 00:23:48
- SHA256: `8FCF5088FFD8E0FFA20C418727A5401105052D0E38EED545710D378B08AA8CE6`
- MD5: `D6C2437C49321AF6130560033E9401B2`
- PE: machine=0x14c subsystem=2 ep=0xc29d imagebase=0x400000 authenticode=False export=0
- Sections: .text vsz=0x1C06A raw=0x1D000 ent=6.57 ; .rdata vsz=0x6638 raw=0x7000 ent=4.75 ; .data vsz=0x5D58 raw=0x2000 ent=3.62 ; .rsrc vsz=0xC16C raw=0xD000 ent=4.52
- Import DLLs: *invalid*
- Imports: *invalid*: ord_12, ord_8
- URL (0): khong
- IP (0): khong
- Keyword hits: {'loadlibrary': 2, 'startup': 2, 'setwindowshookex': 1, 'shellexecute': 1, 'createprocess': 1, 'getprocaddress': 1}
- Full strings: `vietguard_VietGuardJX.sys.strings.txt`

## engine_engine.dll

- Path: `C:\JXVCTK\JxVoCongTruyenKy\engine.dll`
- Size: 402848 | mtime: 2020-02-28 23:02:56
- SHA256: `3BB7F74631C0B51C1E53AF1630371839B04F93EE41B0CB8E0357295715F51A91`
- MD5: `7F0F77B191E766E590963EDFDC899790`
- PE: machine=0x14c subsystem=2 ep=0x309c1 imagebase=0x10000000 authenticode=True export=1358
- Sections: .text vsz=0x3D8CA raw=0x3E000 ent=6.58 RWX! ; .rdata vsz=0x15BA7 raw=0x16000 ent=5.80 ; .data vsz=0x114B0 raw=0x7000 ent=3.92 ; .rsrc vsz=0x51C raw=0x1000 ent=4.13 ; .reloc vsz=0x3822 raw=0x4000 ent=5.90
- Import DLLs: DDRAW.dll, DINPUT8.dll, DSOUND.dll, GDI32.dll, IMM32.dll, KERNEL32.dll, LuaLibDll.dll, MSVCP80.dll, MSVCR80.dll, USER32.dll, WINMM.dll, comdlg32.dll
- Imports: DDRAW.dll: DirectDrawCreate || DSOUND.dll: ord_1 || WINMM.dll: timeKillEvent, timeGetTime, timeSetEvent || DINPUT8.dll: DirectInput8Create || KERNEL32.dll: InterlockedDecrement, GetTickCount, SetLocalTime, GetCurrentThreadId, Sleep, WaitForMultipleObjects, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetCurrentDirectoryA, FindClose, FindNextFileA, SetCurrentDirectoryA, FindFirstFileA, TerminateThread, SuspendThread, ResumeThread, InterlockedIncrement, SetThreadPriority, QueryPerformanceFrequency, QueryPerformanceCounter, GetCurrentProcessId, GetLastError, CreateDirectoryA, DeleteFileA, SetFileAttributesA, CopyFileA, CompareFileTime, GetFileAttributesA || USER32.dll: RegisterClassA, LoadCursorA, LoadIconA, SetFocus, UpdateWindow, CreateWindowExA, SetCursor, DestroyWindow, PostMessageA, WaitMessage, GetMessageA, DispatchMessageA, PostQuitMessage, GetCursorPos, DefWindowProcA, GetSystemMetrics, GetKeyboardLayout, MessageBoxA, SendMessageA, FindWindowA, SetWindowLongA, GetWindowLongA, GetMenu, AdjustWindowRectEx, SetWindowPos, ScreenToClient, ClientToScreen, GetClientRect, PeekMessageA, TranslateMessage || GDI32.dll: GetStockObject || comdlg32.dll: GetSaveFileNameA, GetOpenFileNameA || LuaLibDll.dll: lua_isnumber, lua_close, lua_open, lua_baselibopen, lua_iolibopen, lua_strlibopen, lua_mathlibopen, lua_dblibopen, lua_setgcthreshold, lua_getgcthreshold, lua_newpack, lua_newtag, lua_joinpack, lua_clearpack, lua_isstring, lua_call, Lua_SetTable_StringFromId, Lua_SetTable_DoubleFromId, Lua_SetTable_IntFromId, Lua_SetTable_CFunFromName, Lua_SetTable_CFunFromId, Lua_SetTable_StringFromName, Lua_SetTable_IntFromName, Lua_SetTable_DoubleFromName, lua_gettopindex, lua_settop, lua_gettop, lua_pushnumber, lua_pushstring, lua_tonumber || MSVCR80.dll: _open, _close, _write, _chdir, _getcwd, _stricmp, ??3@YAXPAX@Z, ??_V@YAXPAX@Z, __CxxFrameHandler3, ??2@YAPAXI@Z, memset, free, malloc, strrchr, _localtime32, _time32, vsprintf, exit, sprintf, fclose, strncpy, _stat32, fopen, _snprintf, fflush, fwrite, vfprintf, fprintf, ??0exception@std@@QAE@ABQBD@Z, ?what@exception@std@@UBEPBDXZ || MSVCP80.dll: ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z, ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z, ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ, ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z, ?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z, ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ, ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z, ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB, ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z, ??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z || IMM32.dll: ImmRele
- URL (6): ['http://ocsp.verisign.com0', 'http://ocsp.verisign.com01', 'http://ocsp.verisign.com0?', 'http://www.oberhumer.com', 'https://www.verisign.com/cps0*', 'https://www.verisign.com/rpa0']
- IP (0): khong
- Keyword hits: {'http': 17, 'http://': 11, 'https://': 6, 'loadlibrary': 1, 'getprocaddress': 1, 'startup': 1}
- Full strings: `engine_engine.dll.strings.txt`

## film_Game_film.exe

- Path: `C:\JXVCTK\JxVoCongTruyenKy\Game_film.exe`
- Size: 2684872 | mtime: 2026-08-17 00:23:50
- SHA256: `F17D35DF0FC473D379A79E6918E32619F9A47174F957BB77B680FD5BDBF315C9`
- MD5: `D208437EFC6962180D51195712901243`
- PE: machine=0x14c subsystem=2 ep=0x213432 imagebase=0x400000 authenticode=True export=5
- Sections: .text vsz=0x238E8C raw=0x239000 ent=6.11 ; .rdata vsz=0x4146B raw=0x42000 ent=5.05 ; .data vsz=0xFA2E10 raw=0x11000 ent=6.57 ; .rsrc vsz=0xF54 raw=0x1000 ent=5.85
- Import DLLs: ADVAPI32.dll, FilterText.dll, GDI32.dll, IMM32.dll, KERNEL32.dll, LuaLibDll.dll, MSVCP80.dll, MSVCR80.dll, OLEAUT32.dll, SHELL32.dll, USER32.dll, WINMM.dll, WS2_32.dll, comdlg32.dll, engine.dll, ole32.dll
- Imports: WS2_32.dll: inet_ntoa || KERNEL32.dll: CloseHandle, TerminateThread, GetExitCodeThread, FreeLibrary, WaitForSingleObject, GetProcAddress, LoadLibraryA, Sleep, SystemTimeToTzSpecificLocalTime, WritePrivateProfileStringA, GetLastError, CreateProcessA, SetUnhandledExceptionFilter, IsBadReadPtr, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, CreateFileA, FormatMessageA, lstrlenA, CreateSemaphoreA, OpenSemaphoreA, CreateEventA, SetEvent, LeaveCriticalSection, EnterCriticalSection, ResetEvent, CreateThread, InitializeCriticalSection, InterlockedDecrement || USER32.dll: GetDC, CopyRect, CharLowerA, SetWindowLongA, GetWindowLongA, MoveWindow, ReleaseDC, InvalidateRect, BringWindowToTop, SetWindowTextA, wsprintfA, ReleaseCapture, SetCapture, SetCursorPos, InSendMessage, MessageBoxA, GetMessagePos, ScreenToClient, GetKeyState, SetClipboardData, OpenClipboard, GetClipboardData, EmptyClipboard, CloseClipboard, SetCaretPos, EnableWindow, ShowWindow, SetFocus, DestroyWindow, IsWindow || comdlg32.dll: GetOpenFileNameA || ADVAPI32.dll: OpenProcessToken, RegQueryValueExA, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegSetValueExA, RegCreateKeyExA, RegCloseKey || SHELL32.dll: SHGetSpecialFolderPathA, ShellExecuteA || ole32.dll: StgCreateDocfile, OleUninitialize, OleInitialize, OleCreate, OleSetContainedObject, OleSave || FilterText.dll: CreateTextFilter || LuaLibDll.dll: lua_typename, lua_setglobal, lua_getn, lua_stackspace, lua_rawgeti, lua_rawseti, lua_error, lua_newtable, lua_settable, lua_curpack, lua_rawget, lua_pushnil, lua_isstring, lua_pushstring, lua_pushnumber, lua_type, lua_tonumber, lua_gettop, lua_tostring, lua_pushcclosure || MSVCP80.dll: ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z, ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z, ?_Myptr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEPADXZ, ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ, ?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z, ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ, ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z, ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z, ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z, ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z, ??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z, ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z, ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB, ?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ, ?find@?$basic_string@DU?
- URL (8): ['http://jx.kingsoft.com/tan.shtml', 'http://ocsp.verisign.com0', 'http://ocsp.verisign.com0;', 'http://pass.kingsoft.com/jh/', 'http://www.jxqy1.com/news.html', 'https://pay.zing.vn/napcard/volam.html', 'https://www.verisign.com/cps0*', 'https://www.verisign.com/rpa0']
- IP (0): khong
- Keyword hits: {'http': 21, 'http://': 13, 'https://': 7, 'createprocess': 4, 'readprocessmemory': 3, 'loadlibrary': 3, 'minidump': 2, 'writeprocessmemory': 2, 'virtualprotectex': 2, 'getprocaddress': 2, 'createremotethread': 1, 'keybd_event': 1, 'mouse_event': 1, 'sendinput': 1, 'shellexecute': 1, 'startup': 1}
- Full strings: `film_Game_film.exe.strings.txt`

## rainbow_Rainbow.dll

- Path: `C:\JXVCTK\JxVoCongTruyenKy\Rainbow.dll`
- Size: 28064 | mtime: 2026-08-17 00:23:48
- SHA256: `A5386F95B72319AEBFD5EFCE6112D138614FC345326947EAE7A2394E76EB5B62`
- MD5: `92120390FC5E6F503B27DD2B1A3A78BC`
- PE: machine=0x14c subsystem=2 ep=0x3de1 imagebase=0x10000000 authenticode=True export=1
- Sections: .text vsz=0x3606 raw=0x3800 ent=5.73 ; .rdata vsz=0xED2 raw=0x1000 ent=4.44 ; .data vsz=0x428 raw=0x200 ent=2.28 ; .rsrc vsz=0x520 raw=0x600 ent=4.69 ; .reloc vsz=0x38A raw=0x400 ent=6.02
- Import DLLs: KERNEL32.dll, MSVCR80.dll, WS2_32.dll
- Imports: WS2_32.dll: send, recv, WSAGetLastError, WSACleanup, WSAStartup, bind, ioctlsocket, closesocket, socket, htons, connect, inet_ntoa || KERNEL32.dll: GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, InterlockedCompareExchange, InterlockedExchange, Sleep, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, CreateThread, CloseHandle, TerminateThread, WaitForSingleObject || MSVCR80.dll: _except_handler4_common, free, realloc, memcpy, memmove, ??3@YAXPAX@Z, _purecall, ??2@YAPAXI@Z, __CxxFrameHandler3, strncpy, memset, ??_U@YAPAXI@Z, ??_V@YAXPAX@Z, _vsnprintf, _encode_pointer, _malloc_crt, _encoded_null, _decode_pointer, _initterm, _initterm_e, _amsg_exit, _adjust_fdiv, __CppXcptFilter, ?terminate@@YAXXZ, ?_type_info_dtor_internal_method@type_info@@QAEXXZ, _crt_debugger_hook, __clean_type_info_names_internal, _unlock, __dllonexit, _lock
- URL (5): ['http://ocsp.verisign.com0', 'http://ocsp.verisign.com01', 'http://ocsp.verisign.com0?', 'https://www.verisign.com/cps0*', 'https://www.verisign.com/rpa0']
- IP (0): khong
- Keyword hits: {'http': 16, 'http://': 10, 'https://': 6}
- Full strings: `rainbow_Rainbow.dll.strings.txt`

## vggame_current_vggame.exe

- Path: `C:\JXVCTK\JxVoCongTruyenKy\vggame.exe`
- Size: 3167128 | mtime: 2026-08-17 00:24:17
- SHA256: `F66DAA617E67BCF346ED25669051A33D62C0D2522FFC5A127FB3D1D6CE53D78B`
- MD5: `83B68D6C58E3492BDBA454F162256F62`
- PE: machine=0x14c subsystem=2 ep=0x1a9bf70 imagebase=0x400000 authenticode=True export=5
- Sections: (empty) vsz=0x239000 raw=0xD1000 ent=8.00 RWX! ; (empty) vsz=0x42000 raw=0x12000 ent=7.91 RWX! ; (empty) vsz=0xFA3000 raw=0xB000 ent=7.81 RWX! ; (empty) vsz=0x1000 raw=0x1000 ent=0.23 RWX! ; .rsrc vsz=0x1000 raw=0x1000 ent=5.45 RWX! ; (empty) vsz=0x6A0000 raw=0x34000 ent=8.00 RWX! ; .data vsz=0x1DD000 raw=0x1DD000 ent=7.96 RWX!
- Import DLLs: FilterText.dll, IMM32.dll, LuaLibDll.dll, MSVCP80.dll, MSVCR80.dll, WINMM.dll, WS2_32.dll, advapi32.dll, comdlg32.dll, engine.dll, gdi32.dll, kernel32.dll, ole32.dll, oleaut32.dll, shell32.dll, user32.dll, version.dll
- Imports: kernel32.dll: GetModuleHandleA, GetProcAddress, ExitProcess, LoadLibraryA || user32.dll: MessageBoxA || advapi32.dll: RegCloseKey || oleaut32.dll: SysFreeString || gdi32.dll: CreateFontA || shell32.dll: ShellExecuteA || version.dll: GetFileVersionInfoA || WS2_32.dll: inet_ntoa || comdlg32.dll: GetOpenFileNameA || ole32.dll: StgCreateDocfile || FilterText.dll: CreateTextFilter || LuaLibDll.dll: lua_typename || MSVCP80.dll: ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z || MSVCR80.dll: _localtime32 || engine.dll: EDOneTimePad_Decipher || IMM32.dll: ImmAssociateContext || WINMM.dll: timeGetTime
- URL (8): ['http://ocsp.digicert.com0A', 'http://ocsp.digicert.com0C', 'http://ocsp.digicert.com0]', 'http://ocsp.verisign.com0', 'http://ocsp.verisign.com0;', 'http://pki-ocsp.symauth.com0', 'https://www.verisign.com/cps0*', 'https://www.verisign.com/rpa0']
- IP (0): khong
- Keyword hits: {'http': 28, 'http://': 22, 'https://': 6, 'vietguards': 3, 'shellexecute': 1, 'loadlibrary': 1, 'getprocaddress': 1}
- Full strings: `vggame_current_vggame.exe.strings.txt`

# Diff ban cu (trong zip) vs hien tai

- AutoUpdateVCTK.exe: SHA256 KHAC NHAU (F5DC940931CFB808 vs zip 63049DBA6D8E3538)
## Diff cu/moi: AutoUpdateVCTK.exe
- import DLL them moi: ['Normaliz.dll']
- import DLL mat di : khong
- URL moi xuat hien: khong
- URL cu mat di    : khong
  - KERNEL32.dll: +['CreateToolhelp32Snapshot', 'ExpandEnvironmentStringsW', 'GetLocalTime', 'GetTickCount64', 'Process32FirstW', 'Process32NextW', 'ProcessIdToSessionId', 'SetEvent'] | -khong
  - USER32.dll: +['SendMessageTimeoutW', 'ShowWindowAsync', 'WaitForInputIdle'] | -khong
- VLHookPr.dll: SHA256 KHAC NHAU (DB716FF77241E5F5 vs zip 289C8C6FDDDE6F41)
## Diff cu/moi: VLHookPr.dll
- import DLL them moi: khong
- import DLL mat di : khong
- URL moi xuat hien: khong
- URL cu mat di    : khong
  - KERNEL32.dll: +khong | -['GetModuleHandleA']
- VLAutoPr.exe: SHA256 KHAC NHAU (20F9EF68670EDFC2 vs zip DBC66C16C5DDC72E)
## Diff cu/moi: VLAutoPr.exe
- import DLL them moi: khong
- import DLL mat di : khong
- URL moi xuat hien: khong
- URL cu mat di    : khong
- KY_VCTK_CTCX_NEW.exe: SHA256 KHAC NHAU (2C6205FBD41C305E vs zip CB8AB6D044805A8C)
## Diff cu/moi: KY_VCTK_CTCX_NEW.exe
- import DLL them moi: khong
- import DLL mat di : khong
- URL moi xuat hien: khong
- URL cu mat di    : khong
- winmm.dll: SHA256 GIONG NHAU (92858E63788EF967 vs zip 92858E63788EF967)
- vietguards.driver: SHA256 KHAC NHAU (0AC4697919C96396 vs zip 6E91D835E0E3FB4F)
## Diff cu/moi: vietguards.driver
- import DLL them moi: khong
- import DLL mat di : khong
- URL moi xuat hien: khong
- URL cu mat di    : khong
- vggame.exe: SHA256 GIONG NHAU (F66DAA617E67BCF3 vs zip F66DAA617E67BCF3)
- engine.dll: SHA256 GIONG NHAU (3BB7F74631C0B51C vs zip 3BB7F74631C0B51C)