{
  "windows": {
    "ninja_rmm": [
      {
        "process.executable": "C:\\Program Files*\\*\\NinjaRMMAgentPatcher.exe",
        "process.code_signature.subject_name": "NinjaRMM, LLC"
      },
      {
        "process.executable": "C:\\Program Files*\\NinjaRMMAgent\\NinjaRMMAgentPatcher.exe",
        "process.code_signature.subject_name": "NinjaRMM, LLC"
      },
      {
        "process.executable": "C:\\ProgramData\\NinjaRMMAgent\\ninjarmm-cli.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\*\\NinjaRMMAgent.exe",
        "process.code_signature.subject_name": "NinjaRMM, LLC"
      },
      {
        "process.executable": "C:\\Program Files*\\NinjaRMMAgent\\NinjaRMMAgent.exe",
        "process.code_signature.subject_name": "NinjaRMM, LLC"
      }
    ],
    "atera": [
      {
        "process.executable": "C:\\Program Files*\\ATERA Networks\\AteraAgent\\AteraAgent.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageNetworkDiscoveryWG\\AgentPackageNetworkDiscoveryWG.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageAgentInformation\\AgentPackageAgentInformation.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageSTRemote\\AgentPackageSTRemote.exe",
        "process.code_signature.subject_name": "Atera Networks Ltd"
      },
      {
        "process.executable": "C:\\Program Files*\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageFileExplorer\\AgentPackageFileExplorer.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageMonitoring\\AgentPackageMonitoring.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\ATERA Networks\\AteraAgent\\Packages\\AgentPackageRuntimeInstaller\\AgentPackageRuntimeInstaller.exe",
        "process.code_signature.subject_name": ""
      }
    ],
    "gotomeeting": [
      {
        "process.executable": "C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Local\\GoToAssist Remote Support Applet\\*.tmp\\GoToAssistService.exe",
        "process.code_signature.subject_name": "LogMeIn, Inc."
      },
      {
        "process.executable": "C:\\Users\\*\\AppData\\Local\\GoToAssist Remote Support Applet\\*.tmp\\GoToAssistProcessChecker.exe",
        "process.code_signature.subject_name": "LogMeIn, Inc."
      },
      {
        "process.executable": "C:\\Program Files*\\LogMeIn\\GoToAssist Corporate\\*\\G2AC_HostLauncher.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\GoToMeeting\\*\\G2MInstaller.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Users\\*\\AppData\\Local\\GoToMeeting\\*\\g2mcomm.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Users\\*\\AppData\\Local\\GoToMeeting\\*\\g2mlauncher.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\GoToAssist Remote Support Customer\\*\\g2ax_host_service.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\GoToAssist Remote Support Customer\\*\\g2ax_comm_customer.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Users\\*\\AppData\\Local\\GoTo Resolve Applet\\*.tmp\\GoToResolveService.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\GoToAssist Remote Support Unattended\\*\\GoToAssistTools64.exe",
        "process.code_signature.subject_name": "LogMeIn, Inc."
      },
      {
        "process.executable": "C:\\Program Files*\\GoToAssist Remote Support Unattended\\*\\GoToAssistUnattended.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Users\\*\\AppData\\Local\\goto-updater\\pending\\GoToSetup-*.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\GoToMeeting\\*\\g2mlauncher.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Users\\*\\AppData\\Local\\GoToAssist Remote Support Applet\\*.tmp\\GoToAssistCrashHandler.exe",
        "process.code_signature.subject_name": "LogMeIn, Inc."
      },
      {
        "process.executable": "C:\\Users\\*\\AppData\\Local\\GoToMeeting\\*\\g2mupdate.exe",
        "process.code_signature.subject_name": "LogMeIn, Inc."
      }
    ],
    "manage_engine": [
      {
        "process.executable": "C:\\ManageEngine\\DesktopCentralMSP_Server\\jre\\bin\\java.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\ManageEngine\\ADManager Plus\\jre\\bin\\java.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\ManageEngine\\PMP\\tools\\archiver\\windows\\x86-64\\7za.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\ManageEngine\\elasticsearch\\jre\\bin\\java.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\ManageEngine\\PMP\\jre\\bin\\java.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\ManageEngine\\ServiceDesk\\DesktopCentral_Server\\bin\\7za.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\ManageEngine\\ServiceDesk\\DesktopCentral_Server\\bin\\wrapper.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\ManageEngine\\OpManager\\jre\\bin\\java.exe",
        "process.code_signature.subject_name": "Oracle America, Inc."
      },
      {
        "process.executable": "C:\\ManageEngine\\EventLog Analyzer\\jre\\bin\\java.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\ManageEngine\\ADAudit Plus\\pgsql\\bin\\postgres.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\ManageEngine\\OpManager\\Probe\\OpManagerProbe\\pgsql\\bin\\postgres.exe",
        "process.code_signature.subject_name": ""
      }
    ],
    "microsoft_intune": [
      {
        "process.executable": "C:\\Program Files*\\Microsoft Intune Management Extension\\ClientHealthEval.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\WindowsApps\\Microsoft.*\\IntuneManagementExtensionBridge\\IntuneManagementExtensionBridge.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\WindowsApps\\Microsoft.*\\BridgeLauncher\\BridgeLauncher.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\Microsoft Intune Management Extension\\Microsoft.Management.Services.IntuneWindowsAgent.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\Microsoft Intune Management Extension\\Microsoft.Management.Clients.CopyAgentCatalog.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\Microsoft Intune Management Extension\\SensorLogonTask.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\Microsoft Intune Management Extension\\AgentExecutor.exe",
        "process.code_signature.subject_name": ""
      }
    ],
    "n_central": [
      {
        "process.executable": "C:\\Users\\*\\AppData\\Local\\MSP Anywhere for N-central\\Viewer\\Tmp\\SWI_MSP_RC_ViewerUpdate-*.exe",
        "process.code_signature.subject_name": ""
      }
    ],
    "desktop_central": [
      {
        "process.executable": "C:\\Program Files*\\DesktopCentral_Agent\\bin\\dcagentservice.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\DesktopCentral_Agent\\bin\\DCFAService64.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\DesktopCentral_Agent\\bin\\dcagentregister.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\DesktopCentral_Server\\pgsql\\bin\\postgres.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\DesktopCentral_Server\\bin\\wrapper.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\ManageEngine\\DesktopCentral_Server\\bin\\wrapper.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\DesktopCentral_Server\\bin\\UEMS.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\DesktopCentral_Server\\nginx\\dcnginx.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\ManageEngine\\ServiceDesk\\DesktopCentral_Server\\jre\\bin\\java.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\DesktopCentral_Agent\\bin\\EMSAddonInstaller.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\ManageEngine\\DesktopCentral_Server\\jre\\bin\\java.exe",
        "process.code_signature.subject_name": "Azul Systems, Inc."
      },
      {
        "process.executable": "C:\\Program Files*\\DesktopCentral_Server\\apache\\bin\\dcserverhttpd.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\DesktopCentral_Server\\bin\\7za.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\DesktopCentral_Server\\jre\\bin\\java.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\DesktopCentral_Server\\bin\\dcnotificationserver.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\DesktopCentral_Agent\\dcconfig.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\DesktopCentral_Agent\\patches\\*-gimp-*-setup.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\ManageEngine\\AssetExplorer\\DesktopCentral_Server\\bin\\wrapper.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Program Files*\\ManageEngine\\ServiceDesk\\DesktopCentral_Server\\lib\\native\\64bit\\wrapper.dll",
        "process.code_signature.subject_name": "Tanuki Software Ltd."
      },
      {
        "process.executable": "C:\\Program Files*\\ManageEngine\\ServiceDesk\\DesktopCentral_Server\\jre\\bin\\awt.dll",
        "process.code_signature.subject_name": "Azul Systems, Inc."
      },
      {
        "process.executable": "C:\\Program Files*\\ManageEngine\\ServiceDesk\\DesktopCentral_Server\\jre\\bin\\sunec.dll",
        "process.code_signature.subject_name": "Azul Systems, Inc."
      },
      {
        "process.executable": "C:\\Program Files*\\ManageEngine\\ServiceDesk\\DesktopCentral_Server\\jre\\bin\\freetype.dll",
        "process.code_signature.subject_name": "Azul Systems, Inc."
      },
      {
        "process.executable": "C:\\Program Files*\\ManageEngine\\ServiceDesk\\DesktopCentral_Server\\jre\\bin\\fontmanager.dll",
        "process.code_signature.subject_name": "Azul Systems, Inc."
      },
      {
        "process.executable": "C:\\Program Files*\\ManageEngine\\ServiceDesk\\DesktopCentral_Server\\lib\\native\\64bit\\SyMNative.dll",
        "process.code_signature.subject_name": "ZOHO Corporation Private Limited"
      },
      {
        "process.executable": "C:\\Program Files*\\ManageEngine\\ServiceDesk\\DesktopCentral_Server\\lib\\native\\64bit\\OSDSyMNative.dll",
        "process.code_signature.subject_name": "ZOHO Corporation Private Limited"
      }
    ],
    "action1": [
      {
        "process.executable": "C:\\Windows\\Action1\\action1_remote.exe",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "C:\\Windows\\Action1\\action1_agent.exe",
        "process.code_signature.subject_name": "Action1 Corporation"
      }
    ],
    "connect_wise": [
      {
        "process.executable": "C:\\Users\\*\\AppData\\Roaming\\ConnectWise\\cache\\*\\controls\\cef\\ConnectWise.exe",
        "process.code_signature.subject_name": "Connectwise, LLC"
      },
      {
        "process.executable": "C:\\Users\\*\\AppData\\Roaming\\ConnectWise\\cache\\*\\controls\\cef\\ConnectWise.exe",
        "process.code_signature.subject_name": "ConnectWise, LLC"
      },
      {
        "process.executable": "C:\\Program Files*\\ConnectWise\\*\\ConnectWiseManage.exe",
        "process.code_signature.subject_name": "ConnectWise, LLC"
      },
      {
        "process.executable": "C:\\Program Files*\\ScreenConnect\\Bin\\ScreenConnect.Service.exe",
        "process.code_signature.subject_name": "ConnectWise, LLC"
      },
      {
        "process.executable": "C:\\Program Files*\\ScreenConnect\\Bin\\ScreenConnect.Client.exe",
        "process.code_signature.subject_name": "ConnectWise, LLC"
      },
      {
        "process.executable": "C:\\Windows\\LTSvc\\LTSVC.exe",
        "process.code_signature.subject_name": "ConnectWise, LLC"
      },
      {
        "process.executable": "C:\\Users\\*\\Downloads\\ConnectWiseControl.Client.exe",
        "process.code_signature.subject_name": "ConnectWise, LLC"
      }
    ]
  },
  "macos": {
    "ninja_rmm": [
      {
        "process.executable": "/Applications/NinjaRMMAgent/programfiles/ninjarmm-macagent",
        "process.code_signature.subject_name": "Developer ID Application: NinjaRMM LLC (EBNT3ZX97E)"
      }
    ],
    "gotomeeting": [
      {
        "process.executable": "/Applications/GoToMeeting.app/Contents/MacOS/GoToMeeting",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "/Applications/GoToMeeting.app/Contents/Helpers/G2MUpdate",
        "process.code_signature.subject_name": ""
      },
      {
        "process.executable": "/Users/*/Library/Application Support/LogMeInInc/GoToMeeting/G2MUpdate",
        "process.code_signature.subject_name": ""
      }
    ],
    "microsoft_intune": [
      {
        "process.executable": "/Library/Intune/Microsoft Intune Agent.app/Contents/MacOS/IntuneMdmDaemon",
        "process.code_signature.subject_name": ""
      }
    ],
    "n_central": [
      {
        "process.executable": "/Applications/MSP Anywhere Agent N-central.app/Contents/Resources/MSP Anywhere Service Configurator.app/Contents/MacOS/MSP Anywhere Service Configurator",
        "process.code_signature.subject_name": "Developer ID Application: N-able Technologies Inc. (YT3GCGK3Z7)"
      },
      {
        "process.executable": "/Applications/MSP Anywhere Agent N-central.app/Contents/Resources/MSP Anywhere Helper",
        "process.code_signature.subject_name": "Developer ID Application: N-able Technologies Inc. (YT3GCGK3Z7)"
      }
    ],
    "jamf": [
      {
        "process.executable": "/usr/local/jamf/bin/jamf",
        "process.code_signature.subject_name": "Developer ID Application: JAMF Software (483DWKW443)"
      },
      {
        "process.executable": "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon",
        "process.code_signature.subject_name": "Developer ID Application: JAMF Software (483DWKW443)"
      },
      {
        "process.executable": "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/JamfManagementService",
        "process.code_signature.subject_name": "Developer ID Application: JAMF Software (483DWKW443)"
      },
      {
        "process.executable": "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfManagementService.app/Contents/MacOS/jamf_trampoline",
        "process.code_signature.subject_name": "Developer ID Application: JAMF Software (483DWKW443)"
      },
      {
        "process.executable": "/Library/Application Support/JAMF/tmp/jamf",
        "process.code_signature.subject_name": "Developer ID Application: JAMF Software (483DWKW443)"
      }
    ]
  },
  "linux": {}
}