You’ll notice that there are more nested app packages present in Evernote than are reported by osquery