mlruntimed

executablemacOS190.3 KBx86_64, arm64

Analytics submission daemon — collects and uploads diagnostic data to Apple

Gathers system analytics and diagnostic information, then submits it to Apple's telemetry infrastructure via network endpoints. Accesses device encryption keys through Keychain to secure sensitive data during transmission. Exposes four XPC services for other system components to log analytics events and query submission status. Maintains multiple bundle identifiers suggesting it handles analytics for different subsystems or frameworks.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 190.3 KB
UUID: EAD40127-A2AE-3584-9E35-43A0724AC0D0
Analyzed: 2026-04-09T09:55:50Z
CDHash: 5b5663c0f971b7f4bc9c3e7a23530f2213111f85f4afc1d66963af5890c47fa2

Capabilities

KeychainDevice key bag (encryption keys)

/System/Library/PrivateFrameworks/MobileKeyBag.framework/Versions/A/MobileKeyBag

AnalyticsApple unified analytics submission

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics

Frameworks10

Trial(weak)CoreAnalytics DistributedEvaluation Foundation MLRuntime libobjc.A.dylib libSystem.B.dylib CoreFoundation MobileKeyBag TrialProto

Interesting Strings

Bundle IDs(37)

!com.apple.private.dprivacyd.allow "com.apple.private.biome.read-write0k &com.apple.duet.activityscheduler.allow &com.apple.private.xpc.domain-extension 'com.apple.private.photoanalysisd.access

File Paths(11)

/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation /System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics /System/Library/PrivateFrameworks/DistributedEvaluation.framework/Versions/A/DistributedEvaluation /System/Library/PrivateFrameworks/MLRuntime.framework/Versions/A/MLRuntime

telemetry(5)

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics _DESDiagnosticsSubmissionAllowed _OBJC_CLASS_$_DESCoreAnalyticsEventManager bypassDiagnosticsUsage submitWithTRIClient:error:

URLs & Endpoints(5)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.compilers.llvm.clang.1_0</string>https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation

Endpoints(8)

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostnamemacosx26.1.internal

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

DNA Capability Vector

Location

0

Keychain

1

Network

0

Storage

0

Hardware

0

IPC

0

Analytics

1

Security

0

System

0

Behavioral Profile

URL Endpoints

5

Telemetry Strings

5

File Paths

11

Bundle IDs

37

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Codec04c330decd59286df12e55ba569bca6673fbaced4abc5d800960f944687b2ad

Imports13f9e0fde51ffd36ccfbaab025eb3e08c7528b62e2069f237f45ca88ea860f06

Frameworks1fb2c941cc8c29c90d2c2bd7609026fef1977928486e87df2ae19e4d0eb19fae

Classes95b4ef9cb7ed3d031828f8582bc838eeb8a73e9afd398c6b81d9363b83eeb75c

Entitlements278b68d73fc9f78edacb130fedf5ac79867a26e993c1a788d7c1aff3ce0b1aad

Symbols6180f19074e09701abcd245048744677755afbc272e106ead494d98c3dba388d

Static Libraries0 / 76 functions identified

Functions(76)

0x100000f70sub_100000f70

0x100001014sub_100001014

0x10000106csub_10000106c

0x1000011e8sub_1000011e8

0x100001368sub_100001368

0x1000015c8sub_1000015c8

0x100001614sub_100001614

0x10000165csub_10000165c

0x100001800sub_100001800

0x100001bd0sub_100001bd0

0x100001be8sub_100001be8

0x100001bf4sub_100001bf4

0x100001c00-[MLRListenerDelegate initWithXPCActivityManager:]

0x100001ca0-[MLRListenerDelegate listener:shouldAcceptNewConnection:]

0x100001d40-[MLRListenerDelegate .cxx_destruct]

0x100001d4c-[MLRServiceConnection initWithXPCConnection:]

0x100001ed0sub_100001ed0

0x100001ff8sub_100001ff8

0x100002000sub_100002000

0x100002008-[MLRServiceConnection donateJSONResult:identifier:completion:]

Imports122 symbols from 9 dylibs

libSystem.B.dylib67 libobjc.A.dylib27 DistributedEvaluation9 Foundation7 CoreFoundation6

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

gamecontrollerd

powerexperienced

proactiveeventtrackerd

gamecontrolleragentd