Versions

2.0.1.7413	56.52%
2.0.1.7413	21.74%
2.0.1.5417	21.74%

There are 3 versions of richvideo64.exe in the wild, the latest version being 2.0.1.7413. It is started as a Windows Service called 'Cyberlink RichVideo64 Service(CRVS)' with the name 'RichVideo64'. In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). The average file size is about 380.09 KB. The file is a digitally signed and issued to CyberLink by VeriSign. Numerous variations of richvideo64.exe have been installed with both CyberLink Director Suite 5 and PowerDirector11. The executable is a .NET framework assembly utilizing the CLR. During the process's lifecycle, the typical CPU resource utilization is about 0.0002% including both foreground and background operations, the average private memory consumption is about 1.59 MB with the maximum memory reaching around 4.64 MB and typical read I/O operations are around 243 Bytes per minute.