Looks like the botnet was mining on the two largest pools.