who
executablemacOS132.3 KBx86_64, arm64
System utility — connects to remote services for configuration or data retrieval
Executable that initiates outbound network connections to six remote endpoints, likely for fetching configuration data, checking service status, or reporting telemetry. Contains a single bundle identifier reference and four URLs embedded in its strings, indicating communication with external services. The minimal function count suggests a focused utility rather than a complex daemon. Signed by Apple and supports both Intel and ARM architectures.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 132.3 KB
- UUID
- 5BD4D306-EA44-37F1-8E0F-34ECBB09ABF6
- Analyzed
- 2026-04-07T05:21:11Z
- CDHash
- 48ba9c7d91fb8f17875f9f294ed8c7fdc605c621a8fbc669994e7fe183ebf759
Frameworks1
Interesting Strings
Network Surface
DNA Capability Vector
Location
0
Keychain
0
Network
0
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
0
System
0
Behavioral Profile
URL Endpoints
4
Telemetry Strings
0
File Paths
0
Bundle IDs
1
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 2 functions identified
Functions(2)
0x1000005d8sub_1000005d8
0x100000d14sub_100000d14
Imports39 symbols from 1 dylibs
Exports1
_mh_execute_header0x0