[jabroni_salad]

zone.identifier aka "Mark of the Web" and it is responsible for triggering a Smartscreen scan of that file.

You get an 'are you sure you want to run this' and also the Office Protected View, both of which users will reflexively click via muscle memory at this point.

You also get the download and referrer URL attached to every file that came from the internet which is nice for forensics stuff.