Why this happens: SimpleMD is a free, open-source project and is not code-signed, because signing certificates cost money the project does not spend. Windows SmartScreen warns about any unsigned app that has not yet built up download reputation.
Windows protected your PC
Microsoft Defender SmartScreen prevented an unrecognized app from starting.
1. Click "More info"
→
2. Click "Run anyway"
Verify the download yourself:
Every release lists SHA-256 checksums in SHA256SUMS.txt. Compare with certutil -hashfile SimpleMD-Setup.exe SHA256.
The scan reports above match these exact checksums. You can also read every line of the source on GitHub and build it yourself.