select * from launchd where \\
        name = 'com.genieo.completer.download.plist' OR \\
        name = 'com.genieo.completer.update.plist' OR \\
        name = 'com.genieo.completer.ltvbit.plist' OR \\
        name = 'com.installer.completer.download.plist' OR \\
        name = 'com.installer.completer.update.plist' OR \\
        name = 'com.installer.completer.ltvbit.plist' OR \\
        name = 'com.genieoinnovation.macextension.plist' OR \\
        name = 'com.genieoinnovation.macextension.client.plist' OR \\
        name = 'com.genieo.engine.plist';

select * from launchd where program_arguments like '/Users/%/Library/Application Support/%/%.app/Contents/MacOS/App% -trigger download -isDev % -installVersion % -firstAppId % -identity %';

SELECT * FROM users JOIN chrome_extensions USING (uid) WHERE identifier='kaicbfmipfpfpjmlbpejaoaflfdnabnc';

select * from file where directory like '/Users/%/Library/Preferences/8pHbqThW%';

select * from file where path = '/dev/ptmx0';

select * from apps where bundle_identifier = 'com.ht.RCSMac';

select * from launchd where \\
        label = 'com.ht.RCSMac' OR \\
        name = 'com.apple.loginStoreagent.plist' OR \\
        name = 'com.apple.mdworker.plist' OR \\
        name = 'com.apple.UIServerLogin.plist';

select * from hardware_events where path <> '' or model <> '';

select * from file where path in ('/var/lib/games/.k');

SELECT * FROM users JOIN chrome_extensions USING (uid) WHERE identifier='gkojfkhlekighikafcpjkiklfbnlmeio';