Those assignments were not likely arbitrary, as this group had developed BlackEnergy2 for several years in a professional and organized style:  Config with a similar set of plugins for different architectures Here is the list of retrieved files and related functionality:    weap DDoS Attack (various types)   ps password stealer handling a variety of network protocols (SMTP, POP3, IMAP, HTTP, FTP, Telnet)   nm scans ports, stores banners   snif logs IP source and destination, TCP/UDP ports   hook main module: CnC communication, config parser, plugins loader   uper rewrites hook module with a new version and launches it     Weap, Snif, Nm plugin grammar mistakes and mis-spellings The developers’ coding style differed across the ‘Hook’ main module, the plugins, and the Windows main.dll