Sample(s) f1b2bc0831445903c0d51b390b1987597009cc0fade009e07d792e8d455f6db0 5cc62ad6baf572dbae925f701526310778f032bb4a54b205bada78b1eb8c479c   DNS tbs1/tbs2.microsoftonline.services   Domains 0ffice365[.]agency    0ffice365[.]life    0ffice365[.]services    0nedrive[.]agency    corewindows[.]agency    microsoftonline[.]agency    onedrive[.]agency    sharepoint[.]agency    skydrive[.]agency    skydrive[.]services   Sample eb33a96726a34dd60b053d3d1048137dffb1bba68a1ad6f56d33f5d6efb12b97   DNS tvs1/tvs2.trafficmanager.live   Domains akamaiedge[.]live     akamaized[.]live     akdns[.]live     edgekey[.]live    Table 7: Sample and Domain Associations The third cluster of domains had six different nameservers associated with them, but unlike the other two clusters, were all directly tied to each other