Microsoft PlayReady research by Security Explorations:

https://security-explorations.com/microsoft-playready.html

"We have come up with two attack scenarios that make it possible to
extract private ECC keys used by a PlayReady client (Windows SW DRM
scenario) for the communication with a license server and identity
purposes."

https://security-explorations.com/samples/wbpmp_id_compromise_proof.txt