select * from dns_resolvers where type = 'nameserver' and address in ('82.163.143.135', '82.163.142.137');

select * from launchd where name = 'com.Mughthesec.plist';

select * from plist where path = '/Library/Preferences/com.common.plist' and key = 'net_pref';

select * from file \\
        where path like '/Users/%/Library/RenderFiles/activity_agent.app/' OR \\
        path like '/Users/%/Library/LaunchAgents/fr.handbrake.activity_agent.plist' OR \\
        path='/tmp/Updater.app' OR path='/Library/.rand/updateragent.app' OR \\
        path='/Library/LaunchAgents/com.apple.xpcd.plist' OR \\
        path='/Library/.cachedir' OR \\
        path='/Library/.random';

select * from launchd where name='com.Eltima.UpdaterAgent.plist' OR name='com.apple.xpcd.plist';

select * from processes \\
        where path like '/Users/%/Library/RenderFiles/activity_agent.app/Contents/MacOS/activity_agent' OR \\
        path='/Library/.rand/updateragent.app/Contents/MacOS/updateragent' OR \\
        path='/Library/.random/xpcd.app/Contents/MacOS/xpcd';

select * from file \\
         where path = '/Library/LaunchDaemons/com.adobe.update.plist' OR \\
           path = '/Library/Scripts/installd.sh' OR \\
           path = '/Library/Scripts/queue' OR \\
           path = '/tmp/.gdm-socket' OR \\
           path = '/tmp/.gdm-selinux' OR \\
           path LIKE '/var/tmp/.ur-%%';

select * from file where path in ('/dev/grid-hide-pid-', '/dev/grid-unhide-pid-', '/dev/grid-show-pids', '/dev/grid-hide-port-', '/dev/grid-unhide-port-');

select * from package_receipts;

select * from pci_devices;