nscurl

executablemacOS252.8 KBx86_64, arm64

System telemetry agent — collects and transmits diagnostic data to Apple servers

Establishes outgoing network connections to Apple endpoints for uploading system diagnostics and telemetry. Operates during dark wake periods when the display is off, enabling background data collection without user interaction. Accesses Keychain and code signing certificates to authenticate requests. Processes telemetry across 20 bundle identifiers and maintains references to multiple file paths, suggesting collection from various system components and log locations. Communicates via HTTP/FTP and modern networking frameworks.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 252.8 KB
UUID: 01529CF3-B6F1-3013-BBB9-F1B0C8BA6AA5
Analyzed: 2026-04-07T05:21:10Z
CDHash: 247d6eadf9f83dcd340b73c8283ad729fe53cfe9099217fbe93fdf52668b7b2d

Capabilities

NetworkNetwork access during dark wake (display off)

com.apple.private.dark-wake-network-reachability [object Object]

NetworkMake outgoing network connections

com.apple.security.network.client [object Object]

NetworkCore networking (HTTP, FTP, DNS)

/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork

NetworkModern networking framework (NWConnection)

/System/Library/Frameworks/Network.framework/Versions/A/Network

SecurityKeychain, certificates, code signing

/System/Library/Frameworks/Security.framework/Versions/A/Security

Frameworks7

Foundation Security CFNetwork Network libobjc.A.dylib libSystem.B.dylib CoreFoundation

Entitlements8

application-identifier com.apple.nscurl

com.apple.application-identifier com.apple.nscurl

com.apple.developer.networking.multipathtrue

com.apple.developer.networking.multipath_extendedtrue

com.apple.private.dark-wake-network-reachabilitytrue

com.apple.private.nsurlsession.allow-discretionary-cellulartrue

com.apple.private.nsurlsession.impersonatetrue

com.apple.security.network.clienttrue

Interesting Strings

Bundle IDs(20)

com.apple.application-identifier !com.apple.security.network.client (com.apple.developer.networking.multipath *com.apple.private.nsurlsession.impersonate 0com.apple.private.dark-wake-network-reachability

File Paths(6)

/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation /System/Library/Frameworks/Network.framework/Versions/A/Network /System/Library/Frameworks/Security.framework/Versions/A/Security

telemetry(27)

--ats-diagnostics --metrics --tls-diagnostics Print Task-metrics at the end of the connection Starting ATS Diagnostics

URLs & Endpoints(5)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.compilers.llvm.clang.1_0</string>https://www.apple.com/appleca/0

Network Surfaceentitled

Networking Frameworks

CFNetwork CoreFoundation Foundation Network

Endpoints(9)

HostnameCFNetwork-3860.200.71

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostnamemacosx26.1.internal

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

API Usage

DNA Capability Vector

Location

0

Keychain

0

Network

4

Storage

0

Hardware

0

IPC

0

Analytics

0

Security

1

System

0

Behavioral Profile

URL Endpoints

5

Telemetry Strings

27

File Paths

6

Bundle IDs

20

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Codee9f976e4db6dfef0f5113d20dd525d78d984d1a4d016d3da143a69edfb3e5579

Imports5dd0b210b9beab4679be2272d8067503c98277045270e9cdb3d5a62708d39c79

Frameworks382c736c62e1ff1fe51dc33cb0fb3625e1395746c1e9033cdb5e0512a6493b7b

Classesc5d3bb44d2e808073f29dae6a8e002903942d5bbfffb30e83d0bbcfba291ad3a

Entitlements0fd07432f17931eca278a83922c25793435b78b4e1ee6bc2f7bd6cab02a183bc

Symbols44cfadf5e953a57c9e965e99d205d8cf344e67f2b994e54461f8254a0f9a626a

Static Libraries0 / 168 functions identified

Functions(168)

0x100000d58-[NSCURLATSSessionDelegate .cxx_destruct]

0x100000dd8-[NSCURLATSSessionDelegate URLSession:task:didCompleteWithError:]

0x100000e30-[NSCURLATSSessionDelegate executeTLSDiagnostics]

0x100001110sub_100001110

0x10000125csub_10000125c

0x10000126csub_10000126c

0x100001274sub_100001274

0x100001438sub_100001438

0x1000014a8sub_1000014a8

0x100001530sub_100001530

0x100001634sub_100001634

0x1000016acsub_1000016ac

0x10000173c-[NSCURLATSSessionDelegate executeATSFingerprint]

0x100001c50sub_100001c50

0x100001e34sub_100001e34

0x100001e74sub_100001e74

0x100001ebcsub_100001ebc

0x100001f34sub_100001f34

0x100001fb4sub_100001fb4

0x100001ffcsub_100001ffc

Imports114 symbols from 7 dylibs

libSystem.B.dylib34 libobjc.A.dylib23 Foundation18 Network13 CoreFoundation13

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

gamecontrolleragentd

uarppersonalizationd

AssetCacheTetheratorUtil