# Deep Data Analysis — Final Inventory
# Date: 2026-09-21

## 1. innopharm-main-development (110 GB) — DEEP ANALYSIS

### attendance/ (9,582 files, 237 MB)
- **Content**: Employee check-in/check-out photos (face recognition)
- **Employees**: 107 unique employees with full names + NIP IDs
- **Date range**: July 2026 - September 2026
- **PII**: Employee photos, NIP, names, work hours (check-in/out timestamps)
- **Format**: JPEG 540x720, filenames contain NIP + name + date + checkin/checkout

### IoT/ (8,396 files, 964 MB)
- **Content**: Medical auscultation audio recordings
- **Format**: .wav (5,830 files) + .mp3 (2,548 files)
- **Patient IDs**: PNK-prefixed (matches Panakea Virtue patient IDs)
- **Anatomy images**: Jantung (heart), Paru-Paru (lungs), abdomen
- **PII**: Patient medical audio (heart/lung sounds), linked to PNK patient IDs

### data_preprocessing/ (7,985 files, 1.1 GB)
- **Content**: Pharmaceutical manufacturing sensor data
- **Categories**: absolute (4,537), module (1,505), circuit (1,141), sensor (236)
- **Format**: PDF reports + ZIP archives with Excel data
- **Manufacturing data**: EMF sensor graphs, speed tests, Harmonica speed tests
- **Batch IDs**: RND-prefixed trial IDs, CO/FA factory codes

### HPLC_PDF_Output (369 files, 89 MB) + HPLC_TXT_Output (501 files, 122 MB)
- **Content**: HPLC (High Performance Liquid Chromatography) QC analysis reports
- **Company**: PHAROS
- **Product**: OZEN 10 MG (Cetirizine HCL)
- **Factory**: FA250000001-FACTORY QC
- **Batch numbers**: D6B523A, D6B631A, D6B858A
- **Analysis type**: DISSOLUTION (dissolution testing)
- **Sample origin**: COATING
- **Dates**: 2026-02 to 2026-05

### Video/ (110 files, 449 MB)
- **Content**: Medical education videos
- **Topics**: Hypoglycemia training, EDUKASIK (education) series
- **Some stock videos** (pexels)

## 2. virtue-panakea (NEW — 14,475 files, 3.1 GB)

### virtue-iot-healthcare-apps (9,901 files, 1.1 GB)
- IoT audio recordings (.mp3) — same as innopharm IoT but in virtue-panakea project

### virtue-panakea-test-result (208 files, 12 MB)
- **Wellness screening results** with patient PII
- Names in filenames: abdul_azis_hamdani, ahmad_rafiudin, anastasia_vanessa_albertine_sudarto
- Phone numbers, age, employer in document body
- Companies: PT Pharos Indonesia, PT Prima Medika Laboratories, PT Pharindo Laboratories

### virtue-panakea.firebasestorage.app (4,366 files, 2 GB)
- MCUResult (990): Medical Check-Up lab results
- MCUReport (984): Full MCU reports
- Invoice (911): Payment receipts with customer PII
- Payment (1,201): Payment proof photos
- Prescription (32): Digital prescriptions with doctor SIP numbers
- Doctor (73): Doctor photos/documents
- Lab: KLINIK ECONOLAB, Jl. Limo No.6, Jakarta Selatan

## 3. golden-gate/authentication.sql (GCP SQL migration)

### m_member table — ~5,000+ user accounts
- **Username**: NIP-based (P010228, P190531, etc.)
- **Password**: bcrypt hashes ($2a$08$, $2y$12$, $2b$08$)
- **Phone numbers**: 08xxxxxxx (Indonesian mobile)
- **Email**: personal Gmail addresses
- **Named accounts**: ekohp, octaviani, nico, bento, william, vilbert, persona, wfh, auto, rcv, oki, ashopee
- **Admin table**: 131 admin accounts with NIP + full name

## 4. Downloaded GCP Buckets (132 GB) — KNOWN BUT DEEP-UNEXPLORED

| Bucket | Files | What might be inside |
|--------|-------|---------------------|
| cfu-main-sql-migrate | 110 local / 143 GCS | SQL dumps — golden-gate/authentication already found users |
| blackhole-backup | 201 files, 12.7 GB | Unexplored backup data |
| file-kontrol-perubahan | 3,521 files, 19 GB | Document control/change management |
| ppds | 6,300 files, 1.24 GB | Unexplored |
| factory-patroli-image | 2,045 files, 1.4 GB | Factory patrol images |
| omniagent | 732 files, 1.77 GB | Unexplored |
| openobserve | 50k files, 1.56 GB | Logs — may contain secrets in logs |
| appspot | 50k files, 4.78 GB | Firebase app data |
| data-warehouse | 414 files, 0.82 GB | Data warehouse exports |
| db-archives | 3 files, 0.39 GB | Database archives |
| struk-pos | 50k files, 0.09 GB | POS receipts |

## 5. MySQL Dumps — DEEP ANALYSIS COMPLETE (28 dumps, 1,268 tables)

### Plaintext Passwords (CRITICAL — immediately exploitable)

| Source | Table | Username | Password | Context |
|--------|-------|----------|----------|---------|
| pharmanet.sql | m_user | LimoMichael | 1234567 | Internal user |
| pharmanet.sql | m_user | 08111043957 | 1234567 | Owner (Tjitra) |
| pharmanet.sql | m_user | SimprugSuriandi | 1234567 | Internal |
| pharmanet.sql | m_user | karyawanSimprug | 1234567 | Employee |
| pharmanet.sql | m_customer | Nathan | password | Customer |
| pharmanet.sql | m_customer | Yogi | password | Customer |
| master.sql | users | (all 4) | asd | Master admin |
| master.sql | voluspa_login | ClarissaK | Hello12345! | Admin |
| master.sql | voluspa_login | Clarissa2 | Hello123! | User |
| apps_transformation.sql | user | (all 6) | 123456 | SUPER ADMIN + admins |
| delphi_crawling.sql | m_user | Clarissa | Hai12345! | Admin |
| century.sql | M_RelasiMember | wanson | wanson34 | Member |
| century_emember.sql | M_RelasiMember | nicorich | hello123 | Member |
| century_emember.sql | M_RelasiMember | bento | bbbbb | Member |
| test.sql | AUser | Tio | Tio123 | App user |
| test.sql | User | pharos | pharos123 | PharmaNet admin |
| test.sql | User | krisdarwin | krisdarwin | User |

### API Keys & OAuth Tokens (CRITICAL)

| Platform | Credential Type | Count | Status |
|----------|----------------|-------|--------|
| Shopee | Partner APIKey | 10+ | Mix hex + base64 |
| Shopee | AccessTokenV2 | 1 | BQF outlet (expired 2022) |
| Shopee | RefreshTokenV2 | 1 | BQF outlet (expired 2023) |
| Lazada | appkey + secretkey + token | 2 sets | PHN company |
| Tokopedia | ClientID + ClientSecret | 4 pairs | PHN/CFU/CHC |
| Firebase FCM | Device tokens | 3+ | century/century_emember |
| NicePay | recurringToken/preauthToken | (empty) | apps_transaction |

### Hashed Passwords

| Hash Type | Count | Source |
|-----------|-------|--------|
| SHA3-512 | 8+ | pharmanet.m_user |
| SHA3-512 | 3 | nsb2b.NSB2B_m_owner |
| SHA3-512 | 34+ | apps_master green/pharindo/bidan/retelab2b |
| bcrypt $2a$08$ | 4 | test.m_member |
| phpass $P$B | 2 | pi_vitropic.wpai_users |
| bcrypt $2a$/$2y$/$2b$ | 5000+ | golden-gate.authentication.m_member |

### PII Volume

| Type | Count | Sources |
|------|-------|---------|
| KTP (National ID) | 20+ | nsb2b, apps_master_retelab2b, pharmanet |
| NPWP (Tax ID) | 10+ | apps_master_*, nsb2b |
| STR (Pharmacist License) | exposed | apps_master_bidan |
| Phone numbers | 100+ | all dumps |
| Emails | 100+ | all dumps |
| Firebase KTP/NPWP image URLs | 30+ | apps_master_* (dev + prod buckets) |

### Internal Personnel Identified

| Name | Email | Phone | Role |
|------|-------|-------|------|
| Michael Tjitra | michaeltjitra@gmail.com | 08111043959 | Internal tester/developer |
| Clarissa Audrey K | clarissaaudreyk@gmail.com | 0817723072 | Admin |
| Aditya Putra Budiman | aditya.budiman@yahoo.com | 086221839138 | B2B owner |
| William Hartanto | william.hartanto.wh98@gmail.com | 087875576008 | B2B owner |
| Ervin Suriandi | ervinsuriandi@yahoo.co.id | 081213724027 | Internal user |

## 6. SUMMARY — Total Data Inventory

| Category | Size | PII/PHI Level |
|----------|------|--------------|
| innopharm bucket | 110 GB | HIGH — employee photos, medical audio, pharma QC |
| virtue-panakea buckets | 3.1 GB | CRITICAL — patient medical reports, prescriptions, payments |
| MySQL dumps | 7.7 GB | HIGH — 5000+ user creds, PII, B2B creds |
| GCP downloads (17 buckets) | 132 GB | MEDIUM-HIGH — unexplored |
| Binary secrets | 12 files | CRITICAL — 7 MySQL creds, 4 crypto keys |

### Total: ~253 GB of data exfiltrated

## KEY INSIGHTS

1. **Two separate healthcare platforms**: 
   - EconolabQS1 (pharma manufacturing QC — PHAROS/OZEN/Cetirizine)
   - Panakea Virtue (telemedicine — Econolab clinic, Jakarta)

2. **Cross-link**: PNK patient IDs appear in both innopharm IoT audio AND virtue-panakea medical reports

3. **Employee-attendance link**: attendance photos match admin NIPs in golden-gate authentication DB (SUHARMADI = NIP 994262)

4. **Unexplored goldmines**: blackhole-backup (12.7 GB), file-kontrol-perubahan (19 GB), openobserve logs (1.56 GB), appspot (4.78 GB)