The ‘Company’ field in this case, contains the raw command that the attacker wishes to run, downloading and executing the next stage of the malware. Delivery via HTA Loader. In this case the attackers sent an HTML Application file (.hta) to targets most likely as an email attachment