select common_name, sha1, subject_key_id from certificates where subject_key_id = 'e637d656f9f088ddca3b3b55c4fe698d8c97a552';

select * from file where path = '/Users/Shared/AppStore.app';

select * from apps where bundle_name = 'Truesteer.AppStore';

SELECT * FROM file \\
         WHERE path = '/Library/LaunchDaemons/com.startup.plist' OR \\
           path = '/var/root/script.sh' OR \\
           path = '/Users/Shared/dumpdummy' OR \\
           path = '/tmp/script.sh' OR \\
           path = '/tmp/com.startup.plist' OR \\
           path = '/tmp/dumpdummy';

SELECT * FROM launchd WHERE name = 'com.startup.plist';

select * from launchd where name = 'com.client.client.plist';

select * from launchd where name = 'com.apple.hidd.shared.plist';

select * from launchd where name IN ('com.apple.iCloud.sync.daemon', 'com.geticloud.icloud.photo');

select * from file where path = '/Users/Shared/.local/kext' or path = '/Users/Shared/com.apple.updates.plist' or path = '/Users/Shared/start.sh';

select * from certificates where common_name like '%cloudguard.me%' and not_valid_after = '2352216315';