osquery> .mode line
osquery> select h.md5, p.name, p.path, p.cmdline, p.state, p.cwd, p.on_disk from processes as p, hash as h where p.path=h.path group by h.md5,p.on_disk;
    md5 = 002aecc1346bc1eeff57f08e3b6b85c4
   name = soagent
   path = /System/Library/PrivateFrameworks/MessagesKit.framework/Versions/A/Resources/soagent.app/Contents/MacOS/soagent
cmdline = /System/Library/PrivateFrameworks/MessagesKit.framework/Resources/soagent.app/Contents/MacOS/soagent
  state = R
    cwd = /Users/victor/Library/Containers/com.apple.soagent/Data
on_disk = 1