The registry has an entry to the folder. Files are searched for in the directory. Some programs load dependancies based on a file name pattern, such as "NPSWF32*.DLL", then load the highest-ordered search result. Chances are rather high that the original NPSWF32.DLL is being overridden by the .dll with the most recent patch date and version. (That said, they could also use it for base shared functions, but it isn't likely.) This is all part of a program distribution model aimed at rapid, common patching. It's certainly wasteful, taking more disk space and bandwidth than simply patching files. That said, replacement is faster and more foolproof; they don't need to concider things like permissions, read-only access, running programs, or unloading resources. It just works the next time the program is loaded. Plus, if they do need a regression you probably already have the file.