Very nice! Glad you've made it!
Interesting approach for finding the key. Instead of going through the code, let the code tell you what's using. Hat down!

But I suggest you cut or replace with something like "....." the path and names that suggest the ha..ed application name and its folders. Legal stuff, you know...
Both here and on Github. The ones that know what to follow and look will know what to replace in there.

Ok,I agree, I hid the key in my previous post

smarggauges wrote:

@alex_pescaru

Thanks for the tip.

I made a proxy-dll for intercept CryptImportKey call and inject this dll with help AppInit_DLLs.

The key can be found in the file %TEMLP%\hack.txt.
hack.dll: C:\Program Files\Application.exe key:0x08 0x02 0x00 0x00 0x03 0x66 0x00 0x00 0x18 0x00 0x00 0x00 XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX XX

x86 binary and sources is availible on https://github.com/smartgauges/exml