Summary#

In recent versions of Windows 11, notepad added the ability to create tabs and save the history when closed. In order to achieve this it uses a concept called TabState stored inside of .bin files inside of the notepad package folder.

Location#

%localappdata%\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\TabState

Contains files with a the name <Random-GUID>.bin.

File Header#

4E 50

Reference#

Related Articles

Other threads in the archive worth reading next.

Field Notes

Why Does MsMpEng Spawn svchost.exe Without Flags?

An RE deep dive at why Microsoft Defender can create an svchost.exe process without the usual service-host command-line flags.

Field Notes

DismHost - Command-Line, COM Registration, and DLL Loading

Notes from reversing DismHost.exe, the out-of-process COM host used by DISM image sessions.

Field Notes

PowerShell COM Object Execution - A List of Commonly Abused COM Objects

A list of commonly abused COM objects that can be instantiated and manipulated using PowerShell for malicious purposes, along with examples of how they can be used in attack scenarios.