Versions

6.2.9200.16384 (win8_rtm.120725-1247)	1.05%
6.1.7600.16385 (win7_rtm.090713-1255)	31.36%
6.1.7600.16385 (win7_rtm.090713-1255)	56.48%
6.0.6000.16386 (vista_rtm.061101-2205)	8.52%
6.0.6000.16386 (vista_rtm.061101-2205)	0.06%
6.0.6000.16386 (vista_rtm.061101-2205)	0.56%
6.0.6000.16386 (vista_rtm.061101-2205)	1.91%
5.1.2600.5755 (xpsp_sp3_gdr.090206-1234)	0.06%

This is a Windows system installed file with Windows File Protection (WFP) enabled.

There are 8 versions of services.exe in the wild, the latest version being 6.2.9200.16384 (win8_rtm.120725-1247). It is started as a Windows Service called 'Event Log' with the name 'Eventlog' and described as “Hiermee kunnen gebeurtenisberichten die worden uitgegeven door programma's en onderdelen van Windows worden weergegeven in Logboeken. Deze service kan niet worden gestopt.”. . In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). This is executed as a shared service (which simply means that this service can share a process with other Win32 services). The average file size is about 288.13 KB. During the process's lifecycle, the typical CPU resource utilization is about 0.0033% including both foreground and background operations, the average private memory consumption is about 6.77 MB with the maximum memory reaching around 10.45 MB. Addionally, typically read and write I/O disk operations is about 8.32 KB per minute for reads and 23.24 KB per minute for writes.

Service Control Manager (SCM) is a special system process which starts, stops and interacts with Windows service processes. The SCM executable, Services.exe, runs as a Windows console program, and is launched by the Wininit process early during the system startup.