trickbot_1000064.xml

<mcconf>
<ver>1000064</ver>
<gtag>tt0002</gtag>
<servs>
<srv>91.83.88.51:451</srv>
<srv>46.237.117.193:449</srv>
<srv>85.221.243.6:449</srv>
<srv>79.170.7.139:449</srv>
<srv>41.57.103.218:449</srv>
<srv>196.202.194.202:449</srv>
<srv>194.87.103.184:443</srv>
<srv>194.87.102.14:443</srv>
<srv>78.24.217.227:443</srv>
<srv>92.63.102.64:443</srv>
<srv>82.146.40.206:443</srv>
<srv>194.87.238.53:443</srv>
<srv>82.146.59.247:443</srv>
<srv>194.87.239.28:443</srv>
<srv>82.146.47.127:443</srv>
<srv>82.146.56.32:443</srv>
<srv>92.63.102.159:443</srv>
<srv>194.87.232.219:443</srv>
<srv>149.154.69.70:443</srv>
<srv>5.101.78.234:443</srv>
<srv>92.63.102.221:443</srv>
<srv>5.101.78.225:443</srv>
<srv>78.24.223.153:443</srv>
<srv>194.87.92.207:443</srv>
<srv>194.87.94.239:443</srv>
<srv>195.133.147.238:443</srv>
<srv>185.158.113.194:443</srv>
<srv>82.146.45.93:443</srv>
<srv>62.109.15.132:443</srv>
<srv>194.87.236.240:443</srv>
<srv>62.109.16.106:443</srv>
</servs>
<autorun>
<module name="systeminfo" ctl="GetSystemInfo"/>
<module name="injectDll"/>
</autorun>
</mcconf>

<dpost>
<handler>http://194.87.102.39:8082</handler>
</dpost>

<mail> 
<handler>185.158.115.61:443</handler>
</mail>

<bcservers>
<srv ip="66.85.27.117" port="447"/>
</bcservers>

<servconf>
<expir>1514678400</expir>
<plugins>
<psrv>194.87.98.238:447</psrv>
<psrv>195.133.49.17:447</psrv>
<psrv>194.87.93.172:447</psrv>
<psrv>194.87.103.240:447</psrv>
<psrv>195.133.147.102:447</psrv>
<psrv>194.87.99.55:447</psrv>
<psrv>194.87.237.240:447</psrv>
<psrv>185.159.131.127:447</psrv>
<psrv>194.87.238.244:447</psrv>
<psrv>194.87.103.74:447</psrv>
</plugins>
</servconf>

http://195.133.196.4/401.png