swcutil

executablemacOS533.8 KBx86_64, arm64

Analytics submission daemon — collects and transmits system telemetry to Apple

Gathers unified analytics data from the system and submits it to Apple's telemetry endpoints over HTTPS. Accesses Keychain and certificate storage to authenticate submissions and validate code signatures. Exposes three XPC services for other system components to report analytics events. Maintains local telemetry data and manages submission state through standard networking frameworks. Runs as a system daemon with no direct user interaction.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 533.8 KB
UUID: 045A10A4-EF62-32EF-B226-A354B609D0ED
Analyzed: 2026-04-07T05:21:13Z
CDHash: 392716f6d59e69bb9bbc02b16893f8d20475a8f99bc79cf3efb53130c569f820

Capabilities

NetworkModern networking framework (NWConnection)

/System/Library/Frameworks/Network.framework/Versions/A/Network

NetworkCore networking (HTTP, FTP, DNS)

/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork

AnalyticsApple unified analytics submission

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics

SecurityKeychain, certificates, code signing

/System/Library/Frameworks/Security.framework/Versions/A/Security

Frameworks12

CoreAnalytics Network InternationalSupport CFNetwork SharedWebCredentials CoreServices CoreFoundation Foundation Security libobjc.A.dylib libc++.1.dylib libSystem.B.dylib

Entitlements4

com.apple.private.MobileContainerManager.lookup <dict>

com.apple.private.associated-domainstrue

com.apple.private.associated-domains.ignore-required-entitlementstrue

Interesting Strings

Bundle IDs(23)

$com.apple.private.associated-domains /com.apple.private.MobileContainerManager.lookup <key>com.apple.private.MobileContainerManager.lookup</key><key>com.apple.private.associated-domains.ignore-required-entitlements</key><key>com.apple.private.associated-domains</key>

File Paths(14)

/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation /System/Library/Frameworks/Network.framework/Versions/A/Network

telemetry(5)

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics SWCAnalyticsLogger URLSession:task:didFinishCollectingMetrics:_AnalyticsSendEventLazy v40@0:8@"NSURLSession"16@"NSURLSessionTask"24@"NSURLSessionTaskMetrics"32

URLs & Endpoints(4)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CFNetwork CoreFoundation Foundation Network

Endpoints(10)

Hostnameapp-site-association.cdn-apple.com

Hostnamewww.example.com

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

HostnameAcom.apple.private.associated-domains.ignore-required-entitlements

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

API Usage

DNA Capability Vector

Location

0

Keychain

0

Network

2

Storage

0

Hardware

0

IPC

0

Analytics

1

Security

1

System

0

Behavioral Profile

URL Endpoints

4

Telemetry Strings

5

File Paths

14

Bundle IDs

23

IOKit Constants

0

Library Functions

1

Structural HashesSHA-256

Coded5d4ed8d869d31a978d0274474c2eecab07812dae4cb215d36f7ffb5fa84867f

Imports4ac46301064843a8a62aad2660f4e27ae0bc8cb47b9eb44b9be3477352ac8010

Frameworks06cb8e790ed140c074ebe917b6cb42f1dcdd34853b28c802a5cad7699698b83d

Classes18f9cc19e1958a2cca2154a03729532282a1f1ff44cc9cf1bb70b9e6b7c5f427

Entitlements20185d6fcea77e5344bff3cc50823986cf11edfc9912d1213a62f164c2cfe729

Symbols79b76195aaae31880f0f8ddabdd72d4b2bf3d0a9b5f6bcbbc13e521d3cd2d473

Static Libraries1 / 345 functions identified

Identified Libraries

flatbuffers 25.9.23 (1 fn)

Functions(345)

0x1000010f8-[SWCDownloader init]

0x100001250-[SWCDownloader receiveSIGTERMSignal]

0x100001330sub_100001330

0x100001340sub_100001340

0x100001348sub_100001348

0x100001384sub_100001384

0x1000013c0-[SWCDownloader downloadAASAFileForDomain:applicationIdentifier:completionHandler:]

0x100001480-[SWCDownloader downloadAASAFileForDomain:applicationIdentifier:downloadRoute:completionHandler:]

0x1000015e8-[SWCDownloader updateAASAFileForDomain:applicationIdentifier:completionHandler:]

0x1000016a8-[SWCDownloader updateAASAFileForDomain:applicationIdentifier:downloadRoute:completionHandler:]

0x100001810-[SWCDownloader enumerateActiveAASAFileDownloadsWithBlock:]

0x100001900sub_100001900

0x10000199csub_10000199c

0x100001ad8sub_100001ad8

0x100001ae8sub_100001ae8

0x100001af0sub_100001af0

0x100001b38-[SWCDownloader URLSession:task:didReceiveChallenge:completionHandler:]

0x100002150-[SWCDownloader URLSession:task:willPerformHTTPRedirection:newRequest:completionHandler:]

0x100002570-[SWCDownloader URLSession:dataTask:didReceiveResponse:completionHandler:]

0x100003064-[SWCDownloader URLSession:task:didCompleteWithError:]

Imports218 symbols from 11 dylibs

libSystem.B.dylib69 libobjc.A.dylib32 SharedWebCredentials28 CoreFoundation28 Foundation24

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

appleh13camerad

audioclocksyncd

endpointsecurityd

gamecontrollerd