ex

executablemacOS5.4 MBx86_64, arm64

System service — manages telemetry data collection and network reporting

Collects system telemetry and diagnostic information from the macOS device. Communicates with multiple network endpoints to transmit gathered data, likely for analytics or system monitoring purposes. Accesses various file paths and bundles to gather system state information. Runs as a system service with integrated telemetry reporting capabilities and maintains network connections to send collected metrics.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 5.4 MB
UUID: 25F901A9-39E0-3755-A445-640E6C495584
Analyzed: 2026-04-09T09:28:31Z
CDHash: 81a04370ddabef66c7befa72fc8fbecdd146cf97b5e8f15d3c4aa913392b1ea5

Frameworks8

AppKit(weak)CoreServices(weak)libncurses.5.4.dylib libiconv.2.dylib Foundation libobjc.A.dylib libSystem.B.dylib CoreFoundation(weak)

Interesting Strings

Bundle IDs(1)

File Paths(5)

.,~/tmp,/var/tmp,/tmp /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation

telemetry(1)

Geometric shapes

URLs & Endpoints(4)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation

Endpoints(9)

Hostnamevim-163.40.3

Hostnameapple.com

Urlhttp://www.apple.com/appleca/root.crl0

Hostnamewww.apple.com

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

DNA Capability Vector

Location

0

Keychain

0

Network

0

Storage

0

Hardware

0

IPC

0

Analytics

0

Security

0

System

0

Behavioral Profile

URL Endpoints

4

Telemetry Strings

1

File Paths

5

Bundle IDs

1

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Codeaa3c2512a585b9c1d6b5a4f0e344074f07584680cea9bd3533dd8f28cae86c27

Imports39868513eada4149d362e945b90cda545e54afa19a496807a1107713e06ce5c2

Frameworks75a1e7774e3be0513bfaa72bcfd012c9aed736c3a9292603eebbc820902439fd

Classese3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Entitlementse3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Symbols39868513eada4149d362e945b90cda545e54afa19a496807a1107713e06ce5c2

Static Libraries0 / 6561 functions identified

Functions(6561)

0x100000af8sub_100000af8

0x100000d18sub_100000d18

0x100000e98sub_100000e98

0x100000f00sub_100000f00

0x100000fc4sub_100000fc4

0x1000010fcsub_1000010fc

0x100001110sub_100001110

0x1000011e0sub_1000011e0

0x1000011f4sub_1000011f4

0x100001394sub_100001394

0x100001500sub_100001500

0x1000016fcsub_1000016fc

0x100001740sub_100001740

0x1000017a4sub_1000017a4

0x100001908sub_100001908

0x100001968sub_100001968

0x1000019e0sub_1000019e0

0x100001a70sub_100001a70

0x100001b3csub_100001b3c

0x100001bc4sub_100001bc4

Imports254 symbols from 8 dylibs

libSystem.B.dylib218 libncurses.5.4.dylib10 CoreFoundation7 libobjc.A.dylib6 CoreServices5

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable