diff --git a/README.md b/README.md
index 030e447..bd5b237 100644
--- a/README.md
+++ b/README.md
@@ -18,6 +18,18 @@
 >
 > Older releases (v6.4.90 or older) has mismatch commit ID with this new repo, for reference to the exactly same commit, see [MBCP_VersionReference.md](MBCP_VersionReference.md) in repository.
 
+## Checksum
+
+- More information about checksum measure :
+<details>
+
+- Since v6.5.15+, the checksum is more strict, see [this explain](/docs/checksum_newapp.md) for more details.
+
+- The checksum measure (which throws GW934 as response)  is known enabled from the server-side (v6.4.64 works since days 0, but return with GW934 error after 11 days), it requires client (MBCP/MBBank) app to sent the SHA256 hash of 3 app libraries `libapp.so` | `libmbshield.so` | `libclosestmadagascar.so` and all of 5 dex files (classes1->5.dex) to the server for comparing hash, and if it doesn't match, the server will prevent the app from logging in with GW934 error : `Re-install app to continue using app.`
+- The other function (eg: DigitalOTP) that works without logging in still works.
+
+</details>
+
 ## Introduction
 
 > Fact : MBCP / MBZDefend-Fix is my "hobby project", I maintain it in my free times :>
@@ -338,15 +350,6 @@ Early note : When I created @mbbmod channel back in 2023, no one knows it for mo
 
 - [x] Adapt new v6.4.68 trungthu theme
 
-## Old measure
-
-- More information about GW934 measure :
-<details>
-
-- The `GW934` error is known enabled from the server-side (v6.4.64 works since days 0, but return with GW934 error after 11 days), it requires client (MBCP/MBBank) app to sent the SHA256 hash of 3 app libraries `libapp.so` | `libmbshield.so` | `libclosestmadagascar.so` and all of 5 dex files (classes1->5.dex) to the server for comparing hash, and if it doesn't match, the server will prevent the app from logging in with GW934 error : `Re-install app to continue using app.`
-- The other function (eg: DigitalOTP) that works without logging in still works.
-
-</details>
 
 ## Credits
 - [apktool](https://github.com/iBotPeaches/Apktool)
diff --git a/docs/checksum_newapp.md b/docs/checksum_newapp.md
new file mode 100644
index 0000000..553d891
--- /dev/null
+++ b/docs/checksum_newapp.md
@@ -0,0 +1,43 @@
+
+
+# MBBank v6.5.15+  checksum list
+
+in first day of v6.5.15+ released, there is no such checksum, it still the same as before, only until 4 days since release, there is toggle in backend that enable the check, remain unaffected for older base
+
+same as v6.4.63+, in first day nothing happens, no checksum, but after 9 days, checksum appears.
+
+if one of these is modified (even one bit) will trigger checksum fail that refuse to accept login from
+
+all of this is both app & server side, server side ask for checksum, the client get sha256 hash and send to server side `getSHFiles` and if something mismatch, the server side will refuse to login and return GW934 as response to app
+
+```shell
+# outside assets (v6.5.15+)
+mb.apk/AndroidManifest.xml
+mb.apk/lib/arm64-v8a/*.so # previously is libapp / zshield & zdefend libs only since v6.4.63+
+mb.apk/lib/armeabi-v7a/*.so # previously is libapp / zshield & zdefend libs only since v6.4.63+
+mb.apk/classes*.dex # since v6.4.63+
+
+# in assets
+# zimperium (v6.5.15+)
+mb.apk/assets/zimperium_local_model_randomized_filename* 
+mb.apk/assets/zimperium_encrypted_dex_folder/*.odex
+mb.apk/assets/*.szip # zshield encrypted files
+
+# vkey vtap (v6.5.15+)
+mb.apk/assets/firmware # vkey vtap fw
+mb.apk/assets/profile # vkey vtap profile
+mb.apk/assets/signature # vtap vkey signature
+mb.apk/version.json # vtap vkey vos info
+mb.apk/voscodesign.vky
+mb.apk/vkeylicensepack
+
+# singalarity ekyc files (v6.5.15+)
+mb.apk/assets/sgprofile
+mb.apk/assets/smart_ekyc_finall.zip
+mb.apk/assets/media_init_data
+
+# flutter assets (v6.5.15+)
+mb.apk/assets/flutter_assets/assets/fonts/*
+mb.apk/assets/flutter_assets/fonts/*
+mb.apk/assets/flutter_assets/FontManifest.json
+```
\ No newline at end of file