The FROMNET routine sends a request to the server using the WinINet API as well and returns the data from the response. To get an updated configuration and override the hardcoded values, the ransomware sends HTTP GET requests using the same headers as before, to