Re:Seems weird to me (Score 0)

Perhaps a more valid answer is that they checksum and register certain key-dll files thru their activation system, to detect tampering.

And having this certain dll file change twice within the hour would probably trigger some sort of alert to "unlicensed activity"