symptomsd-diag

executablemacOS137.5 KBx86_64, arm64

System telemetry and diagnostics collector — gathers usage data and performance metrics

Collects system diagnostics, performance metrics, and usage telemetry from the local device. Accesses private storage areas to read system logs and configuration data, then transmits findings to Apple endpoints over the network. Integrates with multiple system frameworks to monitor device behavior across different subsystems. Includes telemetry reporting capabilities and communicates with at least seven remote endpoints for data submission.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 137.5 KB
UUID: 5100633C-C19B-3A0E-A759-0E7BF39F60A2
Analyzed: 2026-04-09T10:07:19Z
CDHash: a5d7340d066721f1c00aee0c777c8883734ab02f1640d85462aabb66c0c41aef

Capabilities

StoragePrivate storage area access

com.apple.private.security.storage.AppDataContainers [object Object]

Frameworks6

Foundation AutoBugCaptureCore DiagnosticRequestService libobjc.A.dylib libSystem.B.dylib CoreFoundation

Entitlements25

application-identifier com.apple.symptomsd-diag

com.apple.CommCenter.fine-grained

com.apple.DiagnosticExtensions.extensionHosttrue

com.apple.application-identifier com.apple.symptomsd-diag

com.apple.awdd.manager-accesstrue

com.apple.developer.icloud-services

com.apple.diagnosticpipeline.admintrue

com.apple.diagnosticpipeline.requesttrue

com.apple.private.CacheDelete

CLIENT_ENTITLEMENT ITEMIZED_PURGEABLE_ENTITLEMENT PURGE_ENTITLEMENT CANCEL_PURGE_ENTITLEMENT SERVICE_ENTITLEMENT

com.apple.private.MobileGestalt.AllowedProtectedKeys

SerialNumber UniqueDeviceID

com.apple.private.accounts.allaccountstrue

com.apple.private.aps-connection-initiate

com.apple.power.abc com.apple.symptomsd-diag

com.apple.private.cloudkit.buddyAccesstrue

com.apple.private.cloudkit.setEnvironmenttrue

com.apple.private.cloudkit.spitrue

com.apple.private.cloudkit.systemLaunchDaemonAccesstrue

com.apple.private.cloudkit.systemServicetrue

com.apple.private.logging.admintrue

com.apple.private.osanalytics.defaults.allowtrue

com.apple.private.security.storage.AppDataContainerstrue

com.apple.private.tcc.allow

kTCCServiceLiverpool

com.apple.private.xpc.launchd.per-user-lookuptrue

com.apple.security.system-groups

systemgroup.com.apple.osanalytics

com.apple.symptom_diagnostics.collecttrue

com.apple.tailspin.dump-outputtrue

Interesting Strings

Bundle IDs(58)

com.apple.application-identifier com.apple.security.system-groups0#!com.apple.CommCenter.fine-grained0 !systemgroup.com.apple.osanalytics0*"com.apple.diagnosticpipeline.admin

File Paths(4)

/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation /System/Library/PrivateFrameworks/AutoBugCaptureCore.framework/Versions/A/AutoBugCaptureCore /System/Library/PrivateFrameworks/DiagnosticRequestService.framework/Versions/A/DiagnosticRequestService

telemetry(6)

!systemgroup.com.apple.osanalytics0*%com.apple.symptom_diagnostics.collect ,com.apple.private.osanalytics.defaults.allow <key>com.apple.private.osanalytics.defaults.allow</key><key>com.apple.symptom_diagnostics.collect</key>

URLs & Endpoints(5)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.compilers.llvm.clang.1_0</string>https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation

Endpoints(7)

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostnamemacosx26.1.internal

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

DNA Capability Vector

Location

0

Keychain

0

Network

0

Storage

1

Hardware

0

IPC

0

Analytics

0

Security

0

System

0

Behavioral Profile

URL Endpoints

5

Telemetry Strings

6

File Paths

4

Bundle IDs

58

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Code453edd7d0e92c14b2a39c063945476f129d2e2290f4727944036bbc617fa34be

Imports3ae064e94b5c97fd4c5e4fdb5382fd9d7617abe66065cb4351080223e5d2cc6b

Frameworksea8ae967e5acf2a0c0658e972111845810d7622d24f0d1b5b27174c3d10bded8

Classese3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Entitlements73becb87d3c95d0aae0e172f0fb94b5b67c4ecd141b484cf10b1692d6d09a886

Symbols3ae064e94b5c97fd4c5e4fdb5382fd9d7617abe66065cb4351080223e5d2cc6b

Static Libraries0 / 18 functions identified

Functions(18)

0x100000a70sub_100000a70

0x100000ab4sub_100000ab4

0x100000afcsub_100000afc

0x100000ef0sub_100000ef0

0x1000010d0sub_1000010d0

0x1000010d4sub_1000010d4

0x1000011b0sub_1000011b0

0x1000011b4sub_1000011b4

0x1000011d0sub_1000011d0

0x1000011dcsub_1000011dc

0x1000011f0sub_1000011f0

0x100001238sub_100001238

0x1000012bcsub_1000012bc

0x100001334sub_100001334

0x1000013acsub_1000013ac

0x100001424sub_100001424

0x10000149csub_10000149c

0x100001514sub_100001514

Imports49 symbols from 6 dylibs

libSystem.B.dylib33 libobjc.A.dylib6 CoreFoundation6 DiagnosticRequestService2 Foundation1

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

diagnosticextensionsd

inputanalyticsd

betaenrollmentagent

keyboardservicesd

assetsubscriptiond