The result of PEView and HxD is different. Is it possible? I thought it should be same because it is raw data.
In PEveiw:

In HxD:

The result of PEView and HxD is different. Is it possible? I thought it should be same because it is raw data.
In PEveiw:

In HxD:

The correct value is `F8' according to all my tools on Windows 10, including PEView 0.9.9. Are you running both tools in the exact same environment? In a VM?
F8 is part of the e_lfanew field value in the DOS header, i.e. offset to the new executable header. In layman's terms, it points to the actual NT header (IMAGE_NT_HEADERS in PEView). lfa means long file address. It is a 32-bit (DWORD) relative virtual address (RVA) value. IMAGE_NT_HEADERS is located after the DOS stub and the Rich Signature header if one exists (it does in notepad.exe).
Of interest, using PEView and notepad.exe on a Windows 7 32-bit VN, the value displayed is D8 due to a different Rich Signature header.