> From the linked posts, they were going via a shared downloads directory, so they could not have. Do you mean the Stack Overflow answer? That looks like origi

> From the linked posts, they were going via a shared downloads directory, so they could not have. Do you mean the Stack Overflow answer? That looks like original research to me. Yes, Windows will by default try loading DLLs from the current working directory, but: 1. it has lower priority than the program's own directory, and Notepad++ ships with a copy of SciLexer.dll, and more importantly: 2. Notepad++ specifically only looks for SciLexer.dll in the same directory as the executable itself: https://github.com/notepad-plus-plus/notepad-plus-plus/commit/3fa8a89e76bf523cc4ea7ea1a111cb5ec8f21d4c https://github.com/notepad-plus-plus/notepad-plus-plus/commi... > it wasn't that some bored attacker took the long way around for fun. There are other conceivable reasons for putting the hijack inside a DLL, e.g. because you're more likely to inspect the executable. But permissions wise, it was no easier than modifying the executable.