open_link for reading content from the command-and-control (C&C) server - down_exec for downloading and execute a file - shell to run a command line shell command - locker to run the ransomware routine - kill to terminate a process or itself