mce.dll

Classification Engine Implementation file version info

Library on Windows 2 known copies with hashes

Is it the real mce.dll?

file version info and known copies

Installed inC:\Program Files (x86)\Microsoft Office\root\Office16\
C:\Program Files\Windows Defender Advanced Threat Protection\Classification\

Signed byMicrosoft Windows

ProductMicrosoft Exchange, Microsoft Corporation

DescriptionClassification Engine Implementation

2 known copies

15.20.1622.000 · C:\Program Files\Windows Defender Advanced Threat Protection\Classification\mce.dll · signed by Microsoft Windows

037c39ba917ca326fb6296c3bb981a6083bf3df1695889d60548e899be4e3ac0

15.20.1101.000 · C:\Program Files (x86)\Microsoft Office\root\Office16\mce.dll · signed by Microsoft Corporation

2ff6928aa13e9425f5e5865417916fa5c4ff26c7d7a9cc8b00a9dc68208ba63a

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.