Versions

6.3.9600.16384 (winblue_rtm.130821-1623)	0.47%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.07%
6.2.9200.16384 (win8_rtm.120725-1247)	1.87%
6.2.9200.16384 (win8_rtm.120725-1247)	0.33%
6.2.8250.0 (winmain_win8beta.120217-1520)	0.07%
6.1.7600.16385 (win7_rtm.090713-1255)	27.47%
6.1.7600.16385 (win7_rtm.090713-1255)	57.09%
6.1.7600.16385 (win7_rtm.090713-1255)	0.07%
6.1.1000.18273 (longhorn_mc_dev(wmbla).080702-2311)	0.40%
6.0.6000.16386 (vista_rtm.061101-2205)	8.96%
6.0.6000.16386 (vista_rtm.061101-2205)	1.67%
5.1.2710.2732 (xpsp(wmbla).050805-1239)	1.20%
5.1.2700.2180 (private/xpsp_mce.040810-0205)	0.33%

This is a Windows system installed file with Windows File Protection (WFP) enabled.

There are 13 versions of ehsched.exe in the wild, the latest version being 6.3.9600.16384 (winblue_rtm.130821-1623). It is started as a Windows Service called 'Windows Media Center-Planerdienst' with the name 'ehSched' and described as “Startet und beendet die Aufzeichnung von TV-Sendungen in Windows Media Center”. . It is also run with NETWORK SERVICE privileges. The average file size is about 121.38 KB. Some variations of the file have been seen to be installed with the program Windows XP Media Center Edition 2005 KB2628259 from Microsoft Corporation. During the process's lifecycle, the typical CPU resource utilization is about 0.0075% including both foreground and background operations, the average private memory consumption is about 2.04 MB with the maximum memory reaching around 4.25 MB. Addionally, typically read and write I/O disk operations is about 30 Bytes per minute for reads and 6 Bytes per minute for writes.

Windows Media Center Scheduler Service starts and stops recording of TV programs within Windows Media Center.