mlhostd
executablemacOS1.3 MBx86_64, arm64
iCloud synchronization agent — manages encrypted cloud data sync and background tasks
Synchronizes user data with iCloud servers using encrypted network connections and cryptographic operations. Manages background task scheduling and process lifecycle to maintain sync state across application restarts. Accesses shared application group containers and restricted Mach services to coordinate with other system components. Submits analytics telemetry to Apple through unified analytics framework. Handles file storage exceptions and interacts with RunningBoard to query process state for sync coordination.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 1.3 MB
- UUID
- 7162FCB4-E5BD-38FE-B2E5-794B92DFF5B7
- Analyzed
- 2026-04-09T09:55:44Z
- CDHash
- fd538fd297335afc17d67986ba42c62258c2f84c60893308145057e9fbc14ad0
Capabilities
StorageException: access additional file paths
com.apple.security.exception.files.absolute-path.read-onlyIpcRestricted application group access
com.apple.private.security.restricted-application-groupsIpcShared application group container access
com.apple.security.application-groupsIpcException: access additional Mach services
com.apple.security.exception.mach-lookup.global-nameAnalyticsApple unified analytics submission
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalyticsSecurityCryptographic operations
/System/Library/Frameworks/CryptoKit.framework/Versions/A/CryptoKitSystemBackground task scheduling
/System/Library/PrivateFrameworks/BackgroundSystemTasks.framework/Versions/A/BackgroundSystemTasksSystemProcess lifecycle management
/System/Library/PrivateFrameworks/RunningBoardServices.framework/Versions/A/RunningBoardServicesFrameworks30
FoundationBackgroundSystemTasksCloudKitLighthouseBackgroundPushKitApplePushServiceCryptoKitlibobjc.A.dyliblibSystem.B.dylibCoreFoundationExtensionFoundationBiomeLibraryBiomeStreamsCoreAnalyticsRunningBoardServiceslibswiftAccelerate.dylib(weak)libswiftCore.dyliblibswiftCoreFoundation.dylib(weak)libswiftDispatch.dyliblibswiftIOKit.dylib(weak)libswiftMetal.dylib(weak)libswiftOSLog.dylib(weak)libswiftObjectiveC.dyliblibswiftQuartzCore.dylib(weak)libswiftUniformTypeIdentifiers.dylib(weak)libswiftXPC.dyliblibswift_Builtin_float.dylib(weak)libswift_Concurrency.dyliblibswiftos.dyliblibswiftsimd.dylib(weak)
Entitlements23
Interesting Strings
Bundle IDs(93)
File Paths(24)
telemetry(11)
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalyticsMLHostDaemon: sending device telemetryTask %s has no request, submitting request: %@_$s20LighthouseBackground19CoreAnalyticsEventsO21deviceStatusTelemetryyA2CmFWC_$s20LighthouseBackground19CoreAnalyticsEventsO8rawValueSSvg
Network Surface
Networking Frameworks
Endpoints(8)
DNA Capability Vector
Location
0
Keychain
0
Network
1
Storage
1
Hardware
0
IPC
4
Analytics
1
Security
1
System
2
Behavioral Profile
URL Endpoints
5
Telemetry Strings
11
File Paths
24
Bundle IDs
93
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 876 functions identified
Functions(876)
0x1000018e0sub_1000018e0
0x100001c04sub_100001c04
0x100001fb4sub_100001fb4
0x1000021dcsub_1000021dc
0x100002214sub_100002214
0x10000225csub_10000225c
0x100002264sub_100002264
0x100002268sub_100002268
0x1000022e0sub_1000022e0
0x1000022e4sub_1000022e4
0x100002364sub_100002364
0x100002368sub_100002368
0x1000023acsub_1000023ac
0x1000023b0sub_1000023b0
0x1000023ecsub_1000023ec
0x1000023f0sub_1000023f0
0x100002444sub_100002444
0x100002448sub_100002448
0x1000024bcsub_1000024bc
0x1000024c4sub_1000024c4
Imports917 symbols from 19 dylibs
Exports1
_mh_execute_header0x0