log
executablemacOS773.7 KBx86_64, arm64
System security component — manages device encryption keys and keychain operations
Accesses the device key bag to manage encryption keys used for protecting sensitive data on the system. Exposes an XPC service for other system components to perform cryptographic operations and keychain-related functions. Communicates with 18 network endpoints and collects telemetry data across 17 different signals. Interacts with 15 bundle identifiers, indicating integration with multiple system and application services. Performs cryptographic operations tied to device security and data protection mechanisms.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 773.7 KB
- UUID
- 20EFD3F4-8DF9-316E-A303-08131A45792D
- Analyzed
- 2026-04-07T05:21:14Z
- CDHash
- 4d221a7af964e346d1bbc783440286a513b80175ce2c05b612b9676527deb8db
Capabilities
KeychainDevice key bag (encryption keys)
/System/Library/PrivateFrameworks/MobileKeyBag.framework/Versions/A/MobileKeyBagFrameworks17
MobileKeyBagktrace(weak)LoggingSupportlibcompression.dylibCoreSymbolicationFoundationlibobjc.A.dyliblibc++.1.dyliblibSystem.B.dylibCoreFoundationlibswiftCore.dyliblibswiftCoreFoundation.dylib(weak)libswiftDispatch.dylib(weak)libswiftIOKit.dylib(weak)libswiftObjectiveC.dylib(weak)libswiftXPC.dylib(weak)libswift_Builtin_float.dylib(weak)
Entitlements4
Interesting Strings
Bundle IDs(15)
File Paths(11)
/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation/System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/CoreSymbolication/System/Library/PrivateFrameworks/LoggingSupport.framework/Versions/A/LoggingSupport/System/Library/PrivateFrameworks/MobileKeyBag.framework/Versions/A/MobileKeyBag
telemetry(17)
URLs & Endpoints(6)
https://developer.apple.com/library/content/documentation/Cocoa/Conceptual/Predicates/AdditionalChapters/Introduction.html$http://crl.apple.com/codesigning.crl0%http://www.apple.com/appleca/root.crl0<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">https://www.apple.com/appleca/0
Network Surface
Networking Frameworks
Endpoints(18)
Hostnamelibtrace-1815.40.20
Ipv606:30:00
Hostnamedeveloper.apple.com
Ipv6a:A:c
Ipv608:40:15
Ipv6c:E:f
Hostnamelogdata.statistics.0.jsonl
Hostnamelogdata.statistics.1.jsonl
Hostnameuuidsymmap.apple.com
Hostnamebursar.apple.com
Ipv60:8:16
Hostnamewww.apple.com
Hostnamecrl.apple.com
API Usage
DNA Capability Vector
Location
0
Keychain
1
Network
0
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
0
System
0
Behavioral Profile
URL Endpoints
6
Telemetry Strings
17
File Paths
11
Bundle IDs
15
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 524 functions identified
Functions(524)
0x100001468sub_100001468
0x100001598sub_100001598
0x1000015acsub_1000015ac
0x1000015b0sub_1000015b0
0x1000015b4sub_1000015b4
0x1000015b8sub_1000015b8
0x1000015bcsub_1000015bc
0x1000015c4sub_1000015c4
0x1000015d4sub_1000015d4
0x1000015fcsub_1000015fc
0x100001644sub_100001644
0x100001658sub_100001658
0x1000016a0sub_1000016a0
0x1000016ccsub_1000016cc
0x100001710sub_100001710
0x100001744sub_100001744
0x10000174csub_10000174c
0x1000019fcsub_1000019fc
0x100001a00sub_100001a00
0x100001a18sub_100001a18
Imports416 symbols from 10 dylibs
Exports1
_mh_execute_header0x0