packetzero
03/08/2019, 3:35 PMselect file.path, uid, gid, mode, 0 as atime, mtime, ctime, md5, sha1, sha256 from (select * from file where path like '/System/Library/CoreServices/%.efi' union select * from file where path like '/System/Library/LaunchDaemons/com.apple%efi%') file join hash using (path);
select * from file where
path LIKE '/Users/%/Library/.kernel_%' OR
path LIKE '/Users/%/Library/kernel_service';
SELECT * FROM file WHERE path IN (
SELECT path FROM file WHERE path LIKE '/Users/%/Library/iMovie/%'
UNION
SELECT path FROM file WHERE path LIKE '/Users/%/Library/kernel_service')
zwass
03/08/2019, 4:36 PMpacketzero
03/08/2019, 5:19 PMclong
03/08/2019, 5:51 PMpacketzero
03/08/2019, 5:56 PMclong
03/08/2019, 7:14 PMpacketzero
03/08/2019, 7:18 PM