# Production Binary Analysis — NEW Credentials Found
# Date: 2026-09-21
# Source: QS1__desktop_apps__EconolabQS1_V_1.0.82 — master_manufacturing_be.exe (production)
# Extracted: config_production.pyc, config.pyc, config_local_release.pyc

## NEW CREDENTIALS (not in staging binary)

### config_local_release.pyc — ProductionLocalConfig

| Parameter | Value |
|-----------|-------|
| MySQL host 1 | 34.101.225.67 |
| MySQL user 1 | pharmavid |
| MySQL pass 1 | pharmavid123 (same Fernet-encrypted) |
| MySQL host 2 | 34.124.180.65 |
| MySQL user 2 | prog |
| MySQL pass 2 | vio123 |
| MySQL host 3 | 34.101.220.135 (from config.pyc) |
| MySQL user 3 | pharmavid |
| Local DB | localhost / root / 12345 |
| Local DB 2 | localhost / root / vio123 |
| New DB name | m_manufacture_prod |
| New DB name | cloud_auth |
| New DB name | local_auth |

### config.pyc — Base Config (Development)

| Parameter | Value |
|-----------|-------|
| Flask SECRET_KEY | 4e2e005ca612345f8684b8daa10be810 |
| New MySQL host | 34.101.220.135 |
| User | pharmavid |
| New DB name | m_manufacture_prod |
| New DB names | cloud_auth, local_auth |
| .env file | loaded via dotenv_path |

### config_production.pyc — ProductionConfig

| Parameter | Value |
|-----------|-------|
| Fernet key | wN0oOz0d7dFPysLiaUYWTHG5RstxE9AJ9CqqIu2SqVE= (same) |
| MySQL host | 34.101.249.224 (staging — same as staging binary) |
| User | pharmavid |
| API URLs | same as staging |

## ALL CREDENTIAL MATRIX

| Config class | Host | User | Password | DB | Source |
|--------------|------|------|----------|----|--------|
| ProductionConfig | 34.101.249.224:3306 | pharmavid | pharmavid123 | mprocess, m_manufacture, etc. | config_production.pyc |
| StagingConfig | 34.87.44.167:3306 | grom | d3v3l0p8015 | simpapi | theone/config.pyc |
| StagingConfig (auth) | 34.101.249.224:3306 | pharmavid | pharmavid123 | auth_manufacture | config_staging.pyc |
| ProductionLocalConfig | 34.101.225.67:3306 | pharmavid | pharmavid123 | auth_manufacture | config_local_release.pyc |
| ProductionLocalConfig | 34.124.180.65:3306 | manufactureprog | 6S@Ys{mgxVM-8Zc. | m_manufacture | config_local_release.pyc |
| DevelopmentConfig | 34.101.220.135:3306 | pharmavid | pharmavid123 | + m_manufacture_prod, cloud_auth, local_auth | config.pyc |
| Local | localhost | root | 12345 | same | all configs |
| Local alt | localhost | root | vio123 | same | config_local_release.pyc |

## ENCRYPTION BYPASS HEADER

| Header | Value | Source | Status |
|--------|-------|--------|--------|
| X-Bypass-Encryption | true | theone/middleware.pyc | 403 on external API (WAF blocks) — would work on internal network |

## NEW HOSTS DISCOVERED

| Host | Port | Status | Notes |
|------|------|--------|-------|
| 34.101.220.135 | 3306 | FIREWALLED | GCP IP, dev MySQL (cloud_mprocess_history) |
| 34.101.225.67 | 3306 | FIREWALLED | GCP IP, prod local release MySQL |
| 34.124.180.65 | 3306 | FIREWALLED | GCP IP, manufactureprog/6S@Ys{mgxVM-8Zc. |