https://chainz.cryptoid.info/xmg/block.dws?1805335.htm
https://chainz.cryptoid.info/xmg/block.dws?1807266.htm
https://chainz.cryptoid.info/xmg/block.dws?1807272.htm
https://chainz.cryptoid.info/xmg/block.dws?1807280.htm
https://chainz.cryptoid.info/xmg/block.dws?1807282.htm
https://chainz.cryptoid.info/xmg/block.dws?1807287.htm
Hopefully I didn't pull duplicate addresses...
Here are some wallet addresses I suspect are his:
9LvDoEhev9aVgskEQNrqgnXTQVb6rnaP1m <= His main wallet address
9P3T9LdgYbTnL93n2sWoJzmAtb9nhoZRNc
9SF4424pdanxQuA46XceLMjhzD3BC9Ur15
9CeLMY7PsP9vHymcz5LFnbzv3SXmsfs8fw
9CW7VX7MLcnWvpT51fH6pqhFhjdJzkVsDM
9GEPqShAPecVZzeva8VGYb2ZyTE4PZ5Hb1
The first block you listed appears to be someone sending themselves 15.0 XMG to refresh the age of the coins for PoS, and Vitalik's main wallet sending 472.67172981 XMG to Bittrex for sale on their market.
The second block appears to be one of Vitalik's secondary wallets used to attack with, suggested by the 184 deposits of exactly 40.21785 XMG in a row to 96SSuc36pPAfA6dna45vHuTDMnP7Y9ejsB.
The third block appears to the same deal, except it's to 9SF4424pdanxQuA46XceLMjhzD3BC9Ur15, which is also doing normal, non-attack mining as well.
The fourth block appears to be to a relatively-new wallet (9BHwEr4jyJfMyLCt7huqw1LmxHEqoGhate), but bears much of the same traits of the blocks listed above.
The fifth block comes from 9SBESJHi8W94BYpARocDTjvpMpCCBVL3Ak, which has a heterogeneous mixture of attack transactions (suggested by the small sections of 40.21785 XMG transactions throughout).
The last block appears to be a direct deposit of 40.21785 XMG to his main wallet as a result of his attack.
Edit: I am in the process of uploading a snapshot of the blockchain for anyone who needs it, and removing my 25/04/2018 snapshot.