CmdID

CmdID / Files

MoUsoCoreWorker.exe

MoUSO Core Worker Process file version info

Program on Windows 7 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real MoUsoCoreWorker.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionMoUSO Core Worker Process

7 known copies

10.0.19041.662 (WinBuild.160101.0800) · C:\Windows\system32\MoUsoCoreWorker.exe · signed by Microsoft Windows

22afa24d1a010b9465897bd8657ff34f27efec9ef0aa919eb3f211f1c1026948

10.0.19041.610 (WinBuild.160101.0800) · C:\Windows\system32\MoUsoCoreWorker.exe · signed by Microsoft Windows

a4414d96bd4ba8e42656966171f2a78a7ae9f1d0700cdd04b0801c1ddae38ac6

10.0.19041.488 (WinBuild.160101.0800) · C:\Windows\system32\MoUsoCoreWorker.exe · signed by Microsoft Windows

4d61c6ea5cb8cb6e393fb0042987e4af667bd4314a4918f48a29e497528d60ad

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\system32\MoUsoCoreWorker.exe · signed by Microsoft Windows

86bb2dff3f88b2f1ab8dd2c1b6fa3ce78089791d5c446a587ba5f67cd80f7059

10.0.19041.329 (WinBuild.160101.0800) · C:\Windows\system32\MoUsoCoreWorker.exe · signed by Microsoft Windows

f278e748b6ffdf95038cae2f17f8f99f556b42f22cbf53b6bfc5fea16fc9a46d

10.0.19041.1320 (WinBuild.160101.0800) · C:\Windows\system32\MoUsoCoreWorker.exe · signed by Microsoft Windows

ede5f911823fae6a743e1c24da62d0303d07fec8a50795e8615e2b6946a7acd4

10.0.18362.418 (WinBuild.160101.0800) · C:\WINDOWS\system32\mousocoreworker.exe · signed by Microsoft Windows

0e3f03283f8ba070498351ca3068b3b0ff54df8275b0276bd6b26639fa04ed34

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names MoUsoCoreWorker.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.