Looking at the file stream from Windows 8 built-in SmartScreen

The SmartScreen function was originally designed to protect users from dangerous or counterfeit websites. In Windows 8, this feature has been accepted by the system. If you open a program downloaded from the network, you will get the following prompt:

The system will check the file when opening the file, if there is no rule, a prompt box will pop up. The author was initially confused by such a prompt when using Windows 8, and thought that the program was broken. In fact, the system handles different files. There are a lot of ways to turn it off on the web. This is not the point. Let's see what the file is in the system and make it think it is not safe.
For the right click, you can find a small part (red box) at the bottom of the attribute:

Prompt us that this file is obtained from other places, so for security, the system Automatically locked, click on the button to unlock and access normally, and will not be reminded again. The secret was discovered when learning NTFS: the system uses a special file stream to hold this information, which is not visible using the normal method. The stream name of the file stream is Zone.Identifier, which is only 20 bytes in size. If you want to view it, you need to use the command prompt. In the command prompt, type:
more < IFEO_V2.exe:Zone.Identifier< Br>
will see the following content:
[ZoneTransfer]
ZoneId=3

This is actually an identifier, where ZoneId represents the region. The area here corresponds to the locale in IE, 1 represents a trusted site, 2 represents a local intranet, 3 represents the Internet, and 4 represents a restricted site. According to the default settings, both 1 and 2 can be used normally without prompting, and 3 will get the above prompt. If the ZoneId is 4, you will get the following error message:
The system considers this to be an untrusted program, so the system refuses to open the file. Here, this program will not run unless you manually unlock or adjust the security settings.
Microsoft provides a tool for viewing file streams: streams.exe Use this tool to view file streams for certain files or folders, which can list details such as the size and name of the stream. To view the contents of a file stream, use “more < filename: stream name” (without quotes). Since Windows requires file names to contain no colons, it is impossible to open the contents of the stream using a common desktop program.