Phrozen Unprotect Project - Papers - Phrozen
NTFS Files Attributes 07 Dec 2020

ADS (Alternate Data Stream) is a channel often abused by Malware authors to hide files by abusing the property of NTFS File Systems.

It is mainly used to store: additional payloads, collected data or settings.

An ADS file is completely hidden from explorer. In modern version of Windows, you can display ADS files using the command dir /r or through using third part tools.