packetzero
03/08/2019, 3:35 PMpacketzero
03/08/2019, 3:46 PMselect file.path, uid, gid, mode, 0 as atime, mtime, ctime, md5, sha1, sha256 from (select * from file where path like '/System/Library/CoreServices/%.efi' union select * from file where path like '/System/Library/LaunchDaemons/com.apple%efi%') file join hash using (path);
packetzero
03/08/2019, 3:47 PMpacketzero
03/08/2019, 3:53 PMselect * from file where
path LIKE '/Users/%/Library/.kernel_%' OR
path LIKE '/Users/%/Library/kernel_service';
packetzero
03/08/2019, 3:54 PMSELECT * FROM file WHERE path IN (
SELECT path FROM file WHERE path LIKE '/Users/%/Library/iMovie/%'
UNION
SELECT path FROM file WHERE path LIKE '/Users/%/Library/kernel_service')
zwass
packetzero
03/08/2019, 5:19 PMpacketzero
03/08/2019, 5:22 PMclong
03/08/2019, 5:51 PMpacketzero
03/08/2019, 5:56 PMpacketzero
03/08/2019, 5:57 PMpacketzero
03/08/2019, 6:24 PMclong
03/08/2019, 7:14 PMpacketzero
03/08/2019, 7:18 PM