who

JSON
executablemacOS132.3 KBx86_64, arm64

System utility — connects to remote services for configuration or data retrieval

Executable that initiates outbound network connections to six remote endpoints, likely for fetching configuration data, checking service status, or reporting telemetry. Contains a single bundle identifier reference and four URLs embedded in its strings, indicating communication with external services. The minimal function count suggests a focused utility rather than a complex daemon. Signed by Apple and supports both Intel and ARM architectures.AI

Fingerprint

Platform
macOS
Type
executable
Arch
x86_64, arm64
Min OS
26.1.0
SDK
26.1.0
File Size
132.3 KB
UUID
5BD4D306-EA44-37F1-8E0F-34ECBB09ABF6
Analyzed
2026-04-07T05:21:11Z
CDHash
48ba9c7d91fb8f17875f9f294ed8c7fdc605c621a8fbc669994e7fe183ebf759

Interesting Strings

Network Surface

DNA Capability Vector

Location
0
Keychain
0
Network
0
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
0
System
0

Behavioral Profile

URL Endpoints
4
Telemetry Strings
0
File Paths
0
Bundle IDs
1
IOKit Constants
0
Library Functions
0

Structural HashesSHA-256

Static Libraries0 / 2 functions identified

Functions(2)

0x1000005d8sub_1000005d8
0x100000d14sub_100000d14

Imports39 symbols from 1 dylibs

Exports1

_mh_execute_header0x0