nsurlsessiond
executablemacOS1.6 MBx86_64, arm64
System daemon — manages network connectivity, analytics, and process lifecycle during low-power states
Operates during dark wake (display off) to maintain network reachability monitoring and connectivity state. Manages network configuration through NWConnection and core networking protocols (HTTP, FTP, DNS). Submits system analytics and telemetry to Apple via unified analytics framework. Accesses Keychain for certificate and code signing operations, and communicates with RunningBoard to query process state. Runs 7 XPC services for inter-process communication with other system components. Performs direct hardware/driver communication and maintains private storage.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 1.6 MB
- UUID
- 742B561F-49DA-3834-9334-62798FCCB2BE
- Analyzed
- 2026-04-09T09:58:13Z
- CDHash
- 54ea3b45d7da80983193f7bc2334cf168e1d51dbec33c69dbe91e738840b4474
Capabilities
NetworkNetwork access during dark wake (display off)
com.apple.private.dark-wake-network-reachability[object Object]NetworkModern networking framework (NWConnection)
/System/Library/Frameworks/Network.framework/Versions/A/NetworkNetworkNetwork configuration and reachability
/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfigurationNetworkCore networking (HTTP, FTP, DNS)
/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetworkHardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitIpcApple identity/messaging services (iMessage)
/System/Library/PrivateFrameworks/IDS.framework/Versions/A/IDSIpcProtocol buffer serialization
/System/Library/PrivateFrameworks/ProtocolBuffer.framework/Versions/A/ProtocolBufferAnalyticsApple unified analytics submission
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalyticsSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecuritySystemProcess lifecycle management
/System/Library/PrivateFrameworks/RunningBoardServices.framework/Versions/A/RunningBoardServicesFrameworks31
AppKitCloudDocsDuetActivitySchedulerFileProviderPowerLogUserManagementChronoServices(weak)TapToRadarKit(weak)CoreAnalyticsCoreGraphicsIDSCoreServicesNetworkCoreMediaIOKitAVFoundationProtocolBufferMobileAssetlibsqlite3.dylibSecuritySystemConfigurationStreamingExtractorFoundationCFNetworkAppSupportRunningBoardServicesStreamingZiplibobjc.A.dyliblibc++.1.dyliblibSystem.B.dylibCoreFoundation
Entitlements23
Interesting Strings
Bundle IDs(98)
File Paths(37)
/AppleInternal/Library/Frameworks/TapToRadarKit.framework/Versions/A/TapToRadarKit/System/Library/Frameworks/AVFoundation.framework/Versions/A/AVFoundation/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
telemetry(32)
Network Surface
Networking Frameworks
Endpoints(10)
HostnameCFNetwork-3860.200.71
Ipv60:8:16
Hostnameconfiguration.apple.com
Hostnamewww.apple.com
Hostnamemacosx26.1.internal
Hostnamecrl.apple.com
API Usage
Methods
-[NDAVAssetDownloadSessionWrapper initWithURL:destinationURL:options:delegate:queue:]-[NDAVAssetDownloadSessionWrapper initWithURLAsset:destinationURL:options:delegate:queue:]-[NDAVBackgroundSession dataTaskWithRequest:originalRequest:pipeHandle:identifier:uniqueIdentifier:reply:]-[NDAVBackgroundSession downloadTaskWithRequest:originalRequest:identifier:uniqueIdentifier:reply:]-[NDAVBackgroundSession uploadTaskWithRequest:originalRequest:fromFile:identifier:uniqueIdentifier:reply:]-[NDBackgroundSession dataTaskWithRequest:originalRequest:identifier:uniqueIdentifier:reply:]-[NDBackgroundSession downloadTaskWithRequest:originalRequest:downloadFilePath:identifier:uniqueIdentifier:reply:]-[NDBackgroundSession downloadTaskWithResumeData:identifier:uniqueIdentifier:reply:]-[NDBackgroundSession uploadTaskWithRequest:originalRequest:fromFile:sandboxExtensionData:identifier:uniqueIdentifier:potentialCredentials:reply:]-[NDBackgroundSession uploadTaskWithResumableUploadState:request:originalRequest:fromFile:sandboxExtensionData:identifier:uniqueIdentifier:potentialCredentials:reply:]-[NDNWBackgroundSession dataTaskWithRequest:originalRequest:identifier:uniqueIdentifier:reply:]-[NDNWBackgroundSession downloadTaskWithRequest:originalRequest:downloadFilePath:identifier:uniqueIdentifier:reply:]-[NDNWBackgroundSession downloadTaskWithResumeData:identifier:uniqueIdentifier:reply:]-[NDNWBackgroundSession uploadTaskWithRequest:originalRequest:fromFile:sandboxExtensionData:identifier:uniqueIdentifier:potentialCredentials:reply:]-[NDNWBackgroundSession uploadTaskWithResumableUploadState:request:originalRequest:fromFile:sandboxExtensionData:identifier:uniqueIdentifier:potentialCredentials:reply:]
DNA Capability Vector
Location
0
Keychain
0
Network
4
Storage
1
Hardware
1
IPC
3
Analytics
1
Security
1
System
1
Behavioral Profile
URL Endpoints
6
Telemetry Strings
32
File Paths
37
Bundle IDs
98
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 1133 functions identified
Functions(1133)
0x100001a10-[NDPowerlogReporter .cxx_destruct]
0x100001a1c-[NDPowerlogReporter cancel]
0x100001a20-[NDPowerlogReporter taskTransferredData:countOfBytesReceived:cellular:]
0x100001a4c-[NDPowerlogReporter taskWillSuspend]
0x100001a74-[NDPowerlogReporter taskWillResume]
0x100001ac0-[NDPowerlogReporter initWithTaskDescription:]
0x100001b58sub_100001b58
0x100001c78sub_100001c78
0x100001f08sub_100001f08
0x100001f8csub_100001f8c
0x100002050sub_100002050
0x1000020acsub_1000020ac
0x100002138sub_100002138
0x100002214sub_100002214
0x1000022e0sub_1000022e0
0x100002394sub_100002394
0x100002870sub_100002870
0x100002a4csub_100002a4c
0x100002b24sub_100002b24
0x1000039c4sub_1000039c4
Imports412 symbols from 28 dylibs
Exports1
_mh_execute_header0x0