select * from launchd where name = 'com.apple.FolderActionsxl.plist';

SELECT * FROM users JOIN chrome_extensions USING (uid) WHERE identifier='hinehnlkkmckjblijjpbpamhljokoohh';

SELECT * FROM launchd WHERE path='/Library/LaunchAgents/tapufind.plist';

select * from file where path in ('/usr/include/icekey.h', '/usr/include/iceconf.h', '/usr/include/iceseed.h');

select * from file where path in ('/usr/bin/mailrc');

select * from file where path in ('/usr/lib/locale/uboot');

select * from registry where key='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\MitigationOptions'

select * from file where path in ('/lib/defs');

select * from file where path in ('/usr/lib/libpikapp.a');

select * from launchd where name = 'com.apple.mdworker.plist';