Versions

6.2.9200.16384 (win8_rtm.120725-1247)	1.04%
6.1.7600.16385 (win7_rtm.090713-1255)	31.13%
6.1.7600.16385 (win7_rtm.090713-1255)	56.07%
6.0.6000.16386 (vista_rtm.061101-2205)	8.46%
6.0.6000.16386 (vista_rtm.061101-2205)	0.06%
6.0.6000.16386 (vista_rtm.061101-2205)	0.55%
6.0.6000.16386 (vista_rtm.061101-2205)	1.90%
5.1.2600.5755 (xpsp_sp3_gdr.090206-1234)	0.80%

This is a Windows system installed file with Windows File Protection (WFP) enabled.

There are 8 versions of services.exe in the wild, the latest version being 6.2.9200.16384 (win8_rtm.120725-1247). It is started as a Windows Service called 'Ereignisprotokoll' with the name 'Eventlog' and described as “Ermöglicht die Ansicht von Ereignisprotokollmeldungen von Windows-basierten Programmen und Komponenten in der Ereignisanzeige. Dieser Dienst kann nicht beendet werden.”. . In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). This is executed as a shared service (which simply means that this service can share a process with other Win32 services). The average file size is about 288.13 KB. During the process's lifecycle, the typical CPU resource utilization is about 0.0033% including both foreground and background operations, the average private memory consumption is about 6.75 MB with the maximum memory reaching around 10.42 MB. Addionally, typically read and write I/O disk operations is about 8.25 KB per minute for reads and 23.03 KB per minute for writes.

Service Control Manager (SCM) is a special system process which starts, stops and interacts with Windows service processes. The SCM executable, Services.exe, runs as a Windows console program, and is launched by the Wininit process early during the system startup.