smartscreen.exe

smartscreen.exe evaluates the reputation of downloaded applications and content using Microsoft's SmartScreen service, producing the "Windows protected your PC" prompts for unrecognized programs. It is invoked by the shell when a reputation decision is needed, runs as the user, and lives at C:\Windows\System32\smartscreen.exe.

Legitimately, smartscreen appears around downloads and first-run of new programs and is otherwise idle. It performs checks rather than launching programs, so it does not normally spawn other processes.

smartscreen.exe is a defensive component, so its main relevance is being switched off (T1685). Attackers disable SmartScreen through policy or registry so that downloaded malware runs without a reputation warning, the same playbook as disabling other protections. SmartScreen turning off, or the process being absent where it should run, means a safety check has been removed.

Its trusted name also invites impersonation (T1036.005): a smartscreen.exe outside System32, unsigned, or spawning processes is not the real reputation checker.