Target: com.newroztech.gamewallet (ZiCharge v4.4.0)
Extracted: 2026-07-04
Source: AWS CloudWatch (133 GB) + S3 (545 MB)
Total uploaded: 67,565,067 bytes (64.4 MB)
| # | File | Size | Content |
|---|---|---|---|
| 1 | 00_SUMMARY.txt | 555 | Dump pipeline summary |
| 2 | 01_user_records_full.txt | 2,136,753 | Full user records — passwords, PINs, phones, emails, balances |
| 3 | 02_oauth_tokens.txt | 3,216,677 | OAuth access tokens — session hijack |
| 4 | 03_transactions.txt | 2,676,193 | Fund transfer transactions (P2P, merchant, dealer) |
| 5 | 04_balance_statements.txt | 2,774,194 | Wallet balance movements with descriptions |
| 6 | 05_voucher_card_pins.txt | 4,771,846 | Gift card/voucher PINs and serial numbers |
| 7 | 06_crypto_transactions.txt | 5,825,154 | USDT/BTC crypto transaction gateway logs |
| 8 | 07_activity_logs.txt | 3,088,156 | Login/OTP/device change activity logs |
| 9 | 08_merchant_ipn_logs.txt | 3,209,755 | Merchant payment notifications with real names |
| 10 | 09_user_registrations.txt | 9,253 | New user registrations with initial passwords |
| 11 | 10_password_changes.txt | 11,397,798 | All password change operations |
| 12 | 11_dealer_merchant_transfers.txt | 3,312,013 | Large dealer/merchant transfers |
| 13 | 12_otp_codes.txt | 40 | OTP codes in cleartext |
| 14 | 13_balance_changes.txt | 1,745,459 | All wallet balance UPDATE operations |
| 15 | 14_device_changes.txt | 36 | Device ID change operations (ATO tracking) |
| # | File | Size | Content |
|---|---|---|---|
| 1 | 01_prod_app_auth.txt | 5,351,693 | Production app auth/OTP/sign-in logs |
| 2 | 02_core_v2_prod.txt | 3,213,421 | Java Spring Boot engine logs (auth/crypto/errors) |
| 3 | 03_prod_access.txt | 4,113,031 | HTTP access logs (all requests) |
| 4 | 04_admin_panel.txt | 184,539 | Admin panel application logs |
| 5 | 05_merchant_panel.txt | 115,081 | Merchant panel application logs |
| 6 | 06_sqs_queue.txt | 618,270 | SQS queue messages (payments, transactions) |
| 7 | 07_slow_queries.txt | 4,511,381 | RDS slow query log (complex SQL) |
| 8 | 08_lambda_break-glass-user-password-change.txt | 3,007 | Break-glass password change Lambda |
| 9 | 08_lambda_zicharge-health-checker.txt | 961,859 | Health checker Lambda logs |
| # | File | Size | Content |
|---|---|---|---|
| 1 | application-prod.yml | 12,407 | Spring Boot config (static OTP, JWT, crypto, blocking rules) |
| 2 | City-Prefix.xlsx | 12,567 | City prefix mapping |
| 3 | docker-compose.prod.yml | 7,384 | ALL production secrets (DB, API keys, Twilio, FulgurPay) |
| 4 | gitlab_backup.tar | 552,960 | GitLab backup with source code |
| 5 | gitlab_database.sql | 2,731,943 | GitLab PostgreSQL dump (users, SSH keys) |
| 6 | gitlab_latest.tar | 614,400 | Latest GitLab backup |
| 7 | grafana_dashboards.tar.gz | 49,151 | Grafana dashboard JSON configs |
| 8 | INVENTORY.md | 5,038 | AWS resource inventory |
| 9 | oauth-private.key | 3,272 | RSA 4096-bit private key for JWT signing |
| 10 | oauth-public.key | 800 | RSA public key |
| 11 | OPERATOR_PINs.xlsx | 9,498 | Operator PIN data spreadsheet |
| 12 | pentest_report.md | 62,825 | Complete pentest findings report |
| 13 | poc_crypto_cashout.py | 26,181 | Full attack chain PoC (Grafana→IMDS→S3→RCE→ATO→USDT) |
| 14 | uploads.tar.gz | 240,477 | GitLab uploads archive |