icloudmailagent
executablemacOS764.1 KBx86_64, arm64
System service — manages cross-app group access and keychain credentials with network communication
Provides shared application group container management and restricted Mach service access for coordinated inter-process communication between authorized applications. Accesses keychain items and authenticates through Apple ID services. Uses modern networking (NWConnection) to communicate with 8 network endpoints, including telemetry collection. Exposes 2 XPC services for client applications to query or control group-related functionality. Operates from a private storage area with access restrictions on keychain membership and application group permissions.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 764.1 KB
- UUID
- 1D12FF2A-1D42-30C7-AC24-B53A20679FE5
- Analyzed
- 2026-04-09T09:51:29Z
- CDHash
- fcb25610655b94b82f14bea0822cc9de2f8e70329b70d13b38b054fe2ab5fc07
Capabilities
NetworkModern networking framework (NWConnection)
/System/Library/Frameworks/Network.framework/Versions/A/NetworkIpcRestricted application group access
com.apple.private.security.restricted-application-groupsIpcShared application group container access
com.apple.security.application-groupsIpcException: access additional Mach services
com.apple.security.exception.mach-lookup.global-nameSecurityApple ID authentication
/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/AuthKitFrameworks43
MCCFoundationEmailFoundationMCCKitCategorization_macOSEmailEmailCoreEmailAddressingicloudMCCKitAuthKitFoundationlibobjc.A.dyliblibSystem.B.dylibAccountsCombineCoreFoundationNetworkSwiftDataAppleAccountApplePushServicePDSlibswiftAccelerate.dylib(weak)libswiftCompression.dylib(weak)libswiftCore.dyliblibswiftCoreAudio.dylib(weak)libswiftCoreFoundation.dylib(weak)libswiftCoreImage.dylib(weak)libswiftCoreLocation.dylib(weak)libswiftDispatch.dyliblibswiftIOKit.dylib(weak)libswiftIntents.dylib(weak)libswiftMLCompute.dylib(weak)libswiftMetal.dylib(weak)libswiftNaturalLanguage.dylib(weak)libswiftOSLog.dylib(weak)libswiftObjectiveC.dyliblibswiftObservation.dyliblibswiftPassKit.dylib(weak)libswiftQuartzCore.dylib(weak)libswiftUniformTypeIdentifiers.dylib(weak)libswiftXPC.dylib(weak)libswift_Builtin_float.dylib(weak)libswift_Concurrency.dyliblibswiftos.dyliblibswiftsimd.dylib(weak)
Entitlements21
Interesting Strings
Bundle IDs(70)
File Paths(19)
telemetry(2)
Network Surface
Networking Frameworks
Endpoints(8)
API Usage
DNA Capability Vector
Location
0
Keychain
1
Network
1
Storage
1
Hardware
0
IPC
3
Analytics
0
Security
1
System
0
Behavioral Profile
URL Endpoints
4
Telemetry Strings
2
File Paths
19
Bundle IDs
70
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 894 functions identified
Functions(894)
0x100001ce8sub_100001ce8
0x100001e3csub_100001e3c
0x100001e6csub_100001e6c
0x100002014sub_100002014
0x100002038sub_100002038
0x1000020a0sub_1000020a0
0x100002130sub_100002130
0x100002150sub_100002150
0x100002170sub_100002170
0x1000021f0sub_1000021f0
0x100002210sub_100002210
0x1000022acsub_1000022ac
0x1000022ccsub_1000022cc
0x100002380sub_100002380
0x1000023a0sub_1000023a0
0x100002438sub_100002438
0x1000024e4sub_1000024e4
0x100002594sub_100002594
0x10000260csub_10000260c
0x10000270csub_10000270c
Imports602 symbols from 20 dylibs
Exports1
_mh_execute_header0x0