When the .Internet application operates, the malicious DLL is loaded, and its code is executed in the context with the authentic application.
This is exactly why the "License Manager" plugin has SSL certificate https://zoyatpuj825476.tkzblog.com/29228018/the-app-domain-diaries