Get the hashes of all exe / dll files downloaded from the internet. Checks for the Zone.Identifier ADS and ensures the value is 3.

Get-DownloadedPEHashes.ps1

function Get-DownloadedPEHashes
{
    [CmdletBinding()]
    Param(
        [Parameter(Mandatory=$true, Position=0)]
        [String]$Path,
        [Switch]$Recursive = $true
    )

    if (!$Path.EndsWith('\')) 
    { 
        $Path += '\*'
    } else {
        $Path += '*'
    }

    if ($Recursive)
    {
        Get-ChildItem -path $Path -Recurse -Include *.exe, *.dll `
            | Where-Object { Get-Item $_.FullName -Stream Zone.Identifier -ErrorAction SilentlyContinue } `
            | Where-Object { (Get-Content "$($_.FullName):Zone.Identifier") -like "ZoneId=3" } `
            | % { `
                    if (![String]::IsNullOrEmpty($_.FullName)) `
                    { `
                        Get-FileHash -Path $_.FullName -Algorithm MD5 `
                    } `
                }
    } else {

        Get-ChildItem -path $Path -Include *.exe, *.dll `
            | Where-Object { Get-Item $_.FullName -Stream Zone.Identifier -ErrorAction SilentlyContinue } `
            | Where-Object { (Get-Content "$($_.FullName):Zone.Identifier") -like "ZoneId=3" } `
            | % { `
                    if (![String]::IsNullOrEmpty($_.FullName)) `
                    { `
                        Get-FileHash -Path $_.FullName -Algorithm MD5 `
                    } `
                }
    }
}