```osquery> SELECT value as source_url FROM ext...
# macosf
fritz
08/23/2020, 3:40 PM Copy code
osquery> SELECT value as source_url FROM extended_attributes WHERE path = '/Users/fritz-imac/Downloads/1 (1).txt' AND key = 'where_from';
+------------------------------------------------------------------------+
| source_url |
+------------------------------------------------------------------------+
| <https://itunes.apple.com/lookup?bundleId=com.agilebits.onepassword-ios> |
+------------------------------------------------------------------------+