When the .Web application runs, the malicious DLL is loaded, and its code is executed within the context with the reputable software. That's why the "License supervisor" plugin has SSL certification checking so you https://www.flor.app/