[APP Tunnel] what does it make a client forward traffic to 127.0.0.5?

Hi Experts,

I found an interesting observation but can't explain how it works...

In app tunnel, let's say we've got an internal resource which listens on 192.168.0.10:8080.

I understand when app tunnel is up, there will be a local socks on 127.0.0.5:8080, which forwards traffic to the backend server via APM and this does work as expected.

But on the client, when I also tried accessing 192.168.0.10:8080 on browser directly, it also works, not only in IE but also in Chrome, Firefox...

I thought it may be due to sth added in routing table, but there is no static route for 192.168.0.10 traffic being added. So the question is how the client OS knows that traffic to 192.168.0.10 should be send to 127.0.0.5:8080?

Anybody know how it works internally?