asktod
executablemacOS139.9 KBx86_64, arm64
Process state monitor — queries running processes and manages Mach service access
Queries process state information from RunningBoard to track running applications and system processes. Accesses the keychain to retrieve stored credentials and manages membership in keychain access groups. Communicates with other system services through 6 XPC service interfaces and handles additional Mach service requests through exception handling. Runs as a hardened runtime process with security protections enabled. Interacts with 7 network endpoints and references multiple bundle identifiers, suggesting integration with various macOS system components.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 139.9 KB
- UUID
- 35833770-7ACC-3626-A436-47FB184ED24B
- Analyzed
- 2026-04-09T09:42:13Z
- CDHash
- f5e44497df36a4927494935743d5f97f0ddaeb43a97a26b2684b7a537b1b5715
Capabilities
IpcException: access additional Mach services
com.apple.security.exception.mach-lookup.global-namecom.apple.familycircle.agentcom.apple.identityservicesd.embedded.authcom.apple.ScreenTimeAgent.askcom.apple.identityservicesd.desktop.authcom.apple.biome.PublicStreamAccessServicecom.apple.biome.access.usercom.apple.iconservicescom.apple.iconservices.storecom.apple.people.agentcom.apple.contactsdcom.apple.contactsd.persistencecom.apple.securityd.xpccom.apple.securitydcom.apple.coreservices.quarantine-resolvercom.apple.coreservices.appleeventscom.apple.usernotifications.listener
Frameworks31
AskToDaemonFoundation(weak)libobjc.A.dyliblibSystem.B.dylibCoreFoundationlibswiftAVFoundation.dylib(weak)libswiftAccelerate.dylib(weak)libswiftAppleArchive.dylib(weak)libswiftCompression.dylib(weak)libswiftCore.dyliblibswiftCoreAudio.dylib(weak)libswiftCoreFoundation.dylib(weak)libswiftCoreImage.dylib(weak)libswiftCoreLocation.dylib(weak)libswiftCoreMIDI.dylib(weak)libswiftCoreMedia.dylib(weak)libswiftDispatch.dylib(weak)libswiftIOKit.dylib(weak)libswiftIntents.dylib(weak)libswiftMetal.dylib(weak)libswiftNaturalLanguage.dylib(weak)libswiftOSLog.dylib(weak)libswiftObjectiveC.dylib(weak)libswiftQuartzCore.dylib(weak)libswiftSpatial.dylib(weak)libswiftUniformTypeIdentifiers.dylib(weak)libswiftVideoToolbox.dylib(weak)libswiftXPC.dylib(weak)libswift_Builtin_float.dylib(weak)libswiftos.dyliblibswiftsimd.dylib(weak)
Entitlements28
com.apple.security.exception.mach-lookup.global-name
com.apple.familycircle.agentcom.apple.identityservicesd.embedded.authcom.apple.ScreenTimeAgent.askcom.apple.identityservicesd.desktop.authcom.apple.biome.PublicStreamAccessServicecom.apple.biome.access.usercom.apple.iconservicescom.apple.iconservices.storecom.apple.people.agentcom.apple.contactsdcom.apple.contactsd.persistencecom.apple.securityd.xpccom.apple.securitydcom.apple.coreservices.quarantine-resolvercom.apple.coreservices.appleeventscom.apple.usernotifications.listener
com.apple.security.temporary-exception.mach-lookup.global-name
com.apple.familycircle.agentcom.apple.identityservicesd.embedded.authcom.apple.ScreenTimeAgent.askcom.apple.identityservicesd.desktop.authcom.apple.biome.PublicStreamAccessServicecom.apple.biome.access.usercom.apple.iconservicescom.apple.iconservices.storecom.apple.people.agentcom.apple.contactsdcom.apple.contactsd.persistencecom.apple.securityd.xpccom.apple.securitydcom.apple.coreservices.quarantine-resolvercom.apple.coreservices.appleeventscom.apple.usernotifications.listener
Interesting Strings
Bundle IDs(96)
File Paths(3)
Network Surface
Networking Frameworks
DNA Capability Vector
Location
0
Keychain
1
Network
0
Storage
0
Hardware
0
IPC
2
Analytics
0
Security
1
System
0
Behavioral Profile
URL Endpoints
5
Telemetry Strings
0
File Paths
3
Bundle IDs
96
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 5 functions identified
Functions(5)
0x100001100sub_100001100
0x100001324sub_100001324
0x100001414sub_100001414
0x10000144csub_10000144c
0x1000014ccsub_1000014cc
Imports21 symbols from 6 dylibs
Exports1
_mh_execute_header0x0