routined

executablemacOS144.0 KBx86_64, arm64

Location and telemetry daemon — passive location monitoring with network reporting

Passively observes location updates without user prompts and maintains keychain access for credential storage. Establishes outgoing network connections to transmit telemetry and location data to remote endpoints. Exposes 13 XPC services for inter-process communication with other system components. Runs with hardened runtime protections and accesses location as a system bundle, enabling background operation without user awareness. Communicates with 11 distinct network endpoints, likely for data collection and synchronization.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 144.0 KB
UUID: 48CFA48D-2563-3811-8381-C2E1CF5A9335
Analyzed: 2026-04-09T10:01:52Z
CDHash: de92e4f9b9cc1e3e2bc19de51b59946c69a2580ed3114d973e0df7cf54d17e25

Capabilities

LocationAccess location as a system bundle (no user prompt)

com.apple.locationd.effective_bundle [object Object]

LocationObserve location updates passively

com.apple.locationd.spectator [object Object]

KeychainKeychain access group membership

keychain-access-groups

com.apple.routined apple

NetworkMake outgoing network connections

com.apple.security.network.client [object Object]

SecurityHardened runtime process

com.apple.developer.hardened-process [object Object]

Frameworks5

libcoreroutine.dylib Foundation libobjc.A.dylib libSystem.B.dylib CoreFoundation

Entitlements68

CKSharingSupportedtrue

aps-connection-initiatetrue

com.apple.CoreRoutine-3 com.apple.routined2

com.apple.CoreRoutine.MapItemServicetrue

com.apple.MapsSupport.ParkedCarBulletintrue

com.apple.SafetyMonitor.SafetyCache com.apple.SafetyMonitor.SafetyCache

com.apple.accounts.appleaccount.fullaccesstrue

com.apple.aned.private.allowtrue

com.apple.aonsensed.xpctrue

com.apple.application-identifier com.apple.routined

com.apple.coreduetd.allowtrue

com.apple.developer.aps-environment serverPreferred

com.apple.developer.device-information.user-assigned-device-nametrue

com.apple.developer.extension-host.widget-extensiontrue

com.apple.developer.hardened-processtrue

com.apple.developer.icloud-container-environment Production

com.apple.developer.icloud-container-identifiers

com.apple.SafetyMonitor.SafetyCache com.apple.CoreRoutine-3

com.apple.developer.icloud-services

com.apple.geoservices.navigation_infotrue

com.apple.locationd.activitytrue

com.apple.locationd.authorizeapplicationstrue

com.apple.locationd.effective_bundletrue

com.apple.locationd.harvest.contributetrue

com.apple.locationd.private_infotrue

com.apple.locationd.routinetrue

com.apple.locationd.spectatortrue

com.apple.locationd.statustrue

com.apple.locationd.time_zonetrue

com.apple.maps.model-accesstrue

com.apple.private.aps-connection-initiatetrue

com.apple.private.assets.accessible-asset-types

com.apple.MobileAsset.routined.defaults

com.apple.private.assets.change-daemon-configtrue

com.apple.private.biome.read-only

AppLaunch AppIntent

com.apple.private.calendar.allow-suggestionstrue

com.apple.private.cloudkit.buddyAccesstrue

com.apple.private.cloudkit.serviceNameForContainerMap <dict>

com.apple.private.cloudkit.setEnvironmenttrue

com.apple.private.cloudkit.spitrue

com.apple.private.cloudkit.systemServicetrue

com.apple.private.contactstrue

com.apple.private.coreservices.canmaplsdatabasetrue

com.apple.private.ids.messaging

com.apple.private.alloy.safetymonitor.ownaccount com.apple.private.alloy.safetymonitor com.apple.private.alloy.safetymonitor.multiplex

com.apple.private.ids.messaging.urgent-priority

com.apple.private.alloy.safetymonitor.ownaccount com.apple.private.alloy.safetymonitor

com.apple.private.sqlite.sqlite-encryptiontrue

com.apple.private.tcc.allow

kTCCServiceLiverpool kTCCServiceMotion kTCCServiceAddressBook kTCCServiceCalendar

com.apple.private.ubiquity-additional-kvstore-identifiers

com.apple.MobileSMS

com.apple.proactive.PersonalizationPortrait.Connectionstrue

com.apple.proactive.PersonalizationPortrait.NamedEntity.readOnlytrue

com.apple.rootless.storage.CoreRoutinetrue

com.apple.rootless.storage.coreduet_knowledge_storetrue

com.apple.security.app-sandboxtrue

com.apple.security.exception.shared-preference.read-write

com.apple.MobileSMS

com.apple.security.iokit-user-client-class

com.apple.security.network.clienttrue

com.apple.security.personal-information.addressbooktrue

com.apple.security.personal-information.calendarstrue

com.apple.security.personal-information.locationtrue

com.apple.security.temporary-exception.files.absolute-path.read-only

/usr/libexec /Library/Trial/

com.apple.security.temporary-exception.files.absolute-path.read-write

/Library/Caches/com.apple.DiagnosticReporting.HasBeenAppleInternal

com.apple.security.temporary-exception.files.home-relative-path.read-only

/Library/Logs/CrashReporter//Library/Trial/

com.apple.security.temporary-exception.iokit-user-client-class

AGXCommandQueue AGXSharedUserClient

com.apple.security.temporary-exception.sbpl

(allow file-issue-extension (require-any (extension-class "com.apple.cfprefsd.read") (extension-class "com.apple.cfprefsd.read-write")) (regex #"\/private\/var\/folders\/..\/.*\/0\/com\.apple\.routined\/dv\/Cache\/defaults\.plist")))

com.apple.security.temporary-exception.shared-preference.read-only

com.apple.assistant.backedup

com.apple.timedtrue

com.apple.trial.client

com.apple.wifi.manager-accesstrue

keychain-access-groups

com.apple.routined apple

Interesting Strings

Bundle IDs(194)

com.apple.application-identifier com.apple.locationd.private_info !com.apple.contacts.donation.agent !com.apple.private.biome.read-only0 !com.apple.security.network.client

File Paths(13)

(allow file-issue-extension (require-any (extension-class "com.apple.cfprefsd.read") (extension-class "com.apple.cfprefsd.read-write")) (regex #"\/private\/var\/folders\/..\/.*\/0\/com\.apple\.routined\/dv\/Cache\/defaults\.plist")))0d *com.apple.private.sqlite.sqlite-encryption /Library/Logs/CrashReporter//Library/Trial/0 /Library/Trial/0h

telemetry(2)

<string>com.apple.analyticsd</string>com.apple.analyticsd

URLs & Endpoints(5)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.compilers.llvm.clang.1_0</string>https://www.apple.com/appleca/0

Network Surfaceentitled

Networking Frameworks

CoreFoundation Foundation

Endpoints(11)

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostnamemacosx26.1.internal

HostnameDcom.apple.security.temporary-exception.files.absolute-path.read-only0

HostnameEcom.apple.security.temporary-exception.files.absolute-path.read-write0D

HostnameIcom.apple.security.temporary-exception.files.home-relative-path.read-only0

HostnameBcom.apple.security.temporary-exception.shared-preference.read-only0

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

DNA Capability Vector

Location

2

Keychain

1

Network

1

Storage

0

Hardware

0

IPC

0

Analytics

0

Security

1

System

0

Behavioral Profile

URL Endpoints

5

Telemetry Strings

2

File Paths

13

Bundle IDs

194

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Codebddedd531c1a8c0c5c128516adf6a821117f5cea9b7602f25d99e61fdb8c7673

Importsb620beae10262a1132d656b3424d57f57bc060bd56e27227199d25300d6a586f

Frameworks2ea1f94f8b0d77705a26724e4c78e1a5ec2769a63bf051149657b10b1ff93b1a

Classese3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Entitlements645bdbf8cf8583dd1ebb94b881ecbfe8d502d7a10fe331d9e57dd124739bfe20

Symbolsb620beae10262a1132d656b3424d57f57bc060bd56e27227199d25300d6a586f

Static Libraries0 / 4 functions identified

Functions(4)

0x100000908sub_100000908

0x100000aa8sub_100000aa8

0x100000bd4sub_100000bd4

0x100000c34sub_100000c34

Imports24 symbols from 5 dylibs

libobjc.A.dylib10 libSystem.B.dylib9 Foundation2 CoreFoundation2 libcoreroutine.dylib1

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

diagnosticextensionsd

keyboardservicesd