company
Vendor whose legitimate executable, usually Sang.exe, was renamed to defender.exe and abused as a DLL sideloader.
No current published clusters are mapped here yet.