On Windows, a file downloaded from the internet has the Mark of the Web. When the user click on such a file, Windows shows dialogs that warns users not to open the file, unless the file is signed by a trusted publisher, etc. To identify if a file has the mark, check if its NTFS alternate data stream Zone.Identifier has the following content:
[ZoneTransfer]
ZoneId=3