If running as non-root, it persists as a launch agent: ~/Library/LaunchAgents/com.apple.questd.plist. Below we dump that arguments passed to the install_daemon …first, when the malware is installing itself as a launch agent