@ryan does the output change if you use wildcards? It looks like that

off

has characters on either side of it:

SELECT f.path FROM file AS f JOIN mdfind ON mdfind.path = f.path AND mdfind.query = "kMDItemFSName == '<http://product.info|product.info>' && kMDItemTextContent == '*off*'" WHERE f.path = "/Library/Application Support/Malwarebytes/MBAM/LogsEx/product.info";