usocoreworker.exe
Summary
Windows Update Session Orchestrator Core Worker - handles Windows Update download, installation, and orchestration tasks.
usocoreworker.exe is the 201st most commonly executed Windows program in EchoTrail's dataset, observed 70,716 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by svchost.exe.
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- 3995b7fb2d06456d43e0c03d14ca1a17066e2c947649ae095afee14d8502eb4317.52%
- 077cc9c7b509f833d7d335d6aa3cc104a428e7aef04eae3cbf126b5b269f7bc812.58%
- 2d83fb2d8219f558fffc7a0cc5cee3ebfc8086dfd3440c4f8bdf846df8822b018.92%
- 1aa7c07ff7151cea051af2941ff7a9fe0a09fed4f1cad4cd0298b5078066d4988.62%
- 67e20158897d041ce607d650ec01f012381ecfc4c2340465e55813b2cbaaeadb8.01%
- f87e7baea9304ef284b5fd6e9228c929358aaca106e483b7486134a5368a60b37.26%
- c36b4a7560bf932c7e2ed7f5f0aa47e26c8363bb89ee38b89648fbf1e50df5197%
- 5f34288ae78a90c4cd65110c4818ae0367a7844fe142aa3ef33f8eddce8c1ef36.17%
- c85c397fb0443247ac65ddde3a4417ccffd141c09b689040f48b3df15b424a4d4.96%
- e85708ca1b8db66ef2363efdda9117789085c558373711505fedc363fd93fe374.83%
Process Ancestry
Top Parents
- svchost.exe100%
Top Children
- musnotifyicon.exe97.68%
- WerFault.exe0.01%
- sc.exe<0.01%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about usocoreworker.exe
Rocky answers questions about usocoreworker.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.