oo2core_8_win64.dll: RAD's Oodle library, a stray download, or malware?

What oo2core_8_win64.dll does

Oodle is RAD Game Tools' family of compressors for game data. A developer packs levels, textures and other assets with Oodle when the game is built, so the download is smaller and loading is faster, and the game unpacks them again every time it loads. oo2core_8_win64.dll is the 64-bit Windows library that does the unpacking for games that ship Oodle as a DLL. Modding and unpacking tools for such games load the same file to read the game's archives.

The library does nothing on its own and contacts nothing: the game hands it compressed data and gets the unpacked data back. The risk around the name comes from elsewhere. Games downloaded from cracked or repack sources sometimes arrive without this file, and the copies passed around to fill the gap come from unknown hands. A DLL loaded by a game runs with your rights every time it starts, so a file of unknown origin under this name is a real risk even though RAD's own file is harmless.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How to check a copy of oo2core_8_win64.dll

Four questions decide it: where the file is, where the game came from, what sits next to it, and whether its checksum is known. A library never shows in Task Manager under its own name, and this one has no text fields to read, so use these checks.

1. List every copy and where it sits. A copy in the folder of a game you installed from a store is normal, as is one in a modding tool's folder that you put there. Look closer at copies in Downloads, Desktop, Temp, AppData, System32, or in a game folder that came from a repack.

   Get-ChildItem -Path C:\ -Filter oo2core_8_win64.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

2. Compare the size and checksum. Use the file check on this page. The catalogue copies are 1,006,632 bytes each. A match identifies a copy seen on other PCs; no match is not proof of a fake, because many games ship their own build. A size far from 1 MB is a reason to look closer.

   Get-FileHash "C:\path\to\oo2core_8_win64.dll" -Algorithm SHA256

3. Look at the signature, but do not rely on blank fields. The version resource of the genuine file is empty, so blank Details fields are expected and say nothing either way. Run the signature check: a HashMismatch result means a signed file was changed. NotSigned alone is not proof of a fake for a file of this kind.

   Get-AuthenticodeSignature "C:\path\to\oo2core_8_win64.dll" | Format-List Status, SignerCertificate

4. Think about where the game or the file came from. A store install brings RAD's file with the game. A file downloaded on its own from a DLL site or a forum, or one that came with a repacked game, has no known origin, whatever its name and size say.
5. Look at what sits next to it. Loaders, trainers and unknown .exe or .bat files in the same folder, or a set of DLLs you did not expect, point to a modified game folder. One oo2core file next to the game's .exe is normal.

A matching checksum clears that one file. It says nothing about the installer, the .exe or other files that came with a cracked game, which is where malware from such downloads is usually found.

Do you need oo2core_8_win64.dll?

Keep every copy inside the games you installed from a store, and in tools where you copied it from your own game: without it those programs cannot read the game's data. A copy that failed the checks above came with something you did not choose, and the safe way out is to remove that game or download, not only the DLL.

1. Leave genuine game copies alone. An oo2core_8_win64.dll in a bought game's folder belongs to that game. Deleting it gains nothing and only stops the game from loading its data.
2. Delete copies you downloaded on their own. A copy fetched from a DLL site or a forum and placed in a game or tool folder is of unknown origin. Note its path, run the scan below first, then delete the file and the download it came in.
3. Uninstall a game that came from a repack or a free download. Open Settings, Apps, Installed apps, find the game and uninstall it. Repacks often have no uninstaller: then delete the game's whole folder, not only the DLL, because the risky files are usually elsewhere in it.
4. Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Quarantine what it finds. Look at Protection history afterwards for anything found in Downloads, Temp or AppData.
5. Run the offline scan. Some malware bundled with game downloads hides while Windows runs. The offline scan restarts the PC and scans before Windows starts. It takes about 15 minutes.

   Start-MpWDOScan

6. Change passwords if the download ran an installer you did not trust. Malware bundled with free game downloads is often an information stealer that takes saved browser passwords and session cookies, game store and chat logins included. Change passwords from a clean device and sign out of other sessions.

Warning signs

Known versions of oo2core_8_win64.dll

A public DLL catalogue lists 2 versions of oo2core_8_win64.dll, from 0.0.0.0 to 0.0.0.0, by Unknown. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix oo2core_8_win64.dll errors on uGetFix

Questions people ask