if the .Internet application runs, the malicious DLL is loaded, and its code is executed in the context with the legit software. This is exactly why the "License Manager" plugin has SSL certification checking so it's https://www.flor.app/