alwaysonexclavesd

JSON
executablemacOS193.1 KBx86_64, arm64

System utility — manages bundle operations and XPC service communication

Executable signed by Apple that handles bundle identification and inter-process communication through two XPC services. Interacts with 8 network endpoints and manages 6 bundle identifiers across file operations. Uses 14 frameworks including 2 private APIs to implement core functionality. Maintains single entitlement for specific system capability and processes 64 functions for bundle and service management tasks.AI

Fingerprint

Platform
macOS
Type
executable
Arch
x86_64, arm64
Min OS
26.1.0
SDK
26.1.0
File Size
193.1 KB
UUID
410C37B0-5205-3B45-B59C-E9863C32B54B
Analyzed
2026-04-09T09:40:50Z
CDHash
dcbd95020ea83ef23cacd4ab819086c3e0df0b3ba47adead2985643b87e893ce

Interesting Strings

Network Surface

DNA Capability Vector

Location
0
Keychain
0
Network
0
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
0
System
0

Behavioral Profile

URL Endpoints
4
Telemetry Strings
0
File Paths
3
Bundle IDs
6
IOKit Constants
0
Library Functions
0

Structural HashesSHA-256

Static Libraries0 / 64 functions identified

Functions(64)

0x100001148sub_100001148
0x100001368sub_100001368
0x10000166csub_10000166c
0x100001a64sub_100001a64
0x100001ad4sub_100001ad4
0x100001b44sub_100001b44
0x100001be0sub_100001be0
0x100001c58sub_100001c58
0x100001ca4sub_100001ca4
0x100001cacsub_100001cac
0x100001d3csub_100001d3c
0x100001e08sub_100001e08
0x100001f14sub_100001f14
0x100001f60sub_100001f60
0x100002090sub_100002090
0x10000217csub_10000217c
0x1000021f0sub_1000021f0
0x1000022e4sub_1000022e4
0x100002330sub_100002330
0x10000244csub_10000244c

Imports145 symbols from 8 dylibs

Exports1

_mh_execute_header0x0