HowCurio synthetic NTFS origin-marker observation
October 13, 2026 KST
Native PowerShell test used only an owned71-byte plain-text file, not a real internet download. Its alternate stream was deliberately set to [ZoneTransfer] / ZoneId=3.
Unblock-File -WhatIf preserved the stream. Actual Unblock-File removed it. The main-file SHA256 stayed 3f050ef64508ac176829711463236cfd371a6d5d5da10baf9bcdc0bcbeab1ae3 before/after.
This does not prove file safety, SmartScreen behavior, File Explorer UI or any execution-policy result. No executable was run. No OS/security policy changed.
Original explanation, free to use and adapt.