HackShield launches HSUpdate.exe which then checks if the files are modified or not their, if they are it redownloads them and then warrock loads ehsvc.dll to memory to use (ehsvc.dll is the one it loads but it uses the rest for something or another i dont know what.. dont really care on my part..)