select * from startup_items where path like '%iWorkServices%';

select * from launchd where name = 'com.JavaW.plist';

select * from file where path like '/Library/Application Support/JavaW%';

select * from launchd where name like 'org.%.plist' and program_arguments like '/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java -Dapple.awt.UIElement=true -jar /Users/%/.%';

select * from file where path in ('/usr/include/. .');

select * from processes where name = 'kernel_service';

select * from file where \\
        path LIKE '/Users/%/Library/.kernel_%' OR \\
        path LIKE '/Users/%/Library/kernel_service';

select * from kernel_extensions;

select * from kernel_info;

select * from kernel_modules;