ocr: Image Walk 01800000-C:WINDOWSISYSISYSTEM3ZNOTEPAD.EXE 76A00000-CHWINDOWSIsystem32/USER32.d1 76C40000-CAWINDOWSsystem32/SHELL32.dI1 76EB0000-CAWINDOWSIsystem32/RPCR14.dI TNAUUU-CIWINDOWSSystem3zmtal.di 71870000-CAWINDOWSIsystem32/KERNEL32.dII F1C30000-CHWINDOWSjsystem32/GD132.di 77E30000-CHWINDOWSsystem32/comdig32.dll 77F50000-CIWINDOWSsystem32VADVAP132.d1 OK Figure 17 Determining file images used by Notepad with TINJLIB and IMGWALK.