MoUsoCoreWorker.exe
Also called mousocoreworker, mouse core worker, uso core worker, mo uso
MoUSO core worker for the Windows Update orchestrator (USO). UsoClient.exe is the client CLI. TiWorker.exe is the Trusted Installer worker that applies CBS.
What you need to know
MoUsoCoreWorker is the Update Orchestrator worker, not TiWorker and not UsoClient.
MoUsoCoreWorker.exe does orchestrator work for USO. Scheduled verbs still go through UsoClient.exe. File apply still belongs to TiWorker.exe / TrustedInstaller. The image can also live under Windows\UUS. Ending the core worker does not uninstall an update that TiWorker already started.
- Safe?
- Yes, with Windows Update
- Same as UsoClient?
- No. That one is the CLI
- Same as TiWorker?
- No. TiWorker applies CBS
What is MoUsoCoreWorker.exe?
MoUsoCoreWorker.exe is the Update Orchestrator worker, not TiWorker.exe and not UsoClient.exe. USO uses this process for session work. UsoClient.exe is the command line scheduled tasks call. TiWorker.exe applies component store changes.
What does it do?
It keeps an USO session moving: scan, download coordination, install orchestration. It does not extract CBS payloads the way TiWorker does, and it is not the StartScan verb host.
Why is it running?
Windows Update is scanning, downloading, or staging, or a MoUSO task started the worker. Idle after a finished update is normal. Days of 100 percent disk with no Update history needs CBS and Update logs, not a random End task.
Is it safe?
Usually safe
A Microsoft-signed worker in System32 or Windows\UUS is MoUSO. A MoUsoCoreWorker.exe in Downloads is not. This is still not TiWorker and not UsoClient.
A legitimate copy normally runs from:
C:\Windows\System32\MoUsoCoreWorker.exe
- Also seen under C:\Windows\UUS\amd64
- CLI sibling: UsoClient.exe
- CBS apply sibling: TiWorker.exe
Can I end it?
Not during an Update session
Ending MoUsoCoreWorker.exe can abort orchestration. It does not roll back files TiWorker already wrote. Pause updates in Settings if you need time.
Can I remove it?
No
Do not delete MoUsoCoreWorker.exe. Windows Update orchestration will fail. Removing TiWorker or UsoClient is also wrong.
Should it start with Windows?
USO / Update tasks start it. It is not a Startup Apps checkbox next to UsoClient.
Normal resource behavior
These are contextual labels, not universal averages.
- CPU
- Rises while a session orchestrates
- Memory
- Moderate
- Disk
- Can be high while payloads land. Apply spikes are often TiWorker
- Network
- Download coordination. DoSvc may peer beside it
File information
| Executable name | MoUsoCoreWorker.exe |
|---|---|
| Common legitimate path | C:\Windows\System32\MoUsoCoreWorker.exe |
| Publisher | Microsoft Corporation |
| Signature expectation | Signed by Microsoft Windows |
Common problems
People end TiWorker because this name is loud
TiWorker is the servicing worker. This process is USO. Ending the wrong one mid-apply is how cumulative updates fail.
UsoClient flashed and this worker stayed
Expected. The CLI hands off. The core worker is the longer session.
Troubleshooting
Diagnose before you change anything destructive.
Windows Update history first
If a quality update is in progress, wait or reboot when asked. UsoClient.exe on a task is only the verb that started the session.
Split UUS path from Downloads
Open file location. System32 or Windows\UUS is MoUSO. A worker in a zip is not the orchestrator. Do not end TiWorker to test this host.
Technical details
Technical details
| Image name | MoUsoCoreWorker.exe |
|---|---|
| Role | Update Session Orchestrator core worker |
Sources and verification
Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.
- Microsoft Learn: how Windows Update works · Update Session Orchestrator sits above servicing
- Microsoft Support: Windows · Public support naming
- Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.
Was this article useful?
A yes or no is enough. Pick a reason if you want, or add a short note.
Thanks. That helps us improve this page.