afscexpand
executablemacOS583.7 KBx86_64, arm64
Apple system service — manages telemetry collection and data reporting
Collects diagnostic and usage data from the system through multiple private frameworks and reports it to Apple's telemetry endpoints. Exposes an XPC service for other system components to submit diagnostic information and query telemetry settings. Handles network communication to 78 different endpoints for data transmission, with internal logic for bundling and filtering telemetry payloads. Maintains references to multiple bundle identifiers and processes diagnostic file paths as part of its data gathering workflow.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 11.0.0
- SDK
- 26.1.0
- File Size
- 583.7 KB
- UUID
- CC7AFE73-D47F-37D8-9208-98F673E4A65A
- Analyzed
- 2026-04-07T05:21:16Z
- CDHash
- d253ce881ed7f62f80c919d930edc74d27e087cbd77363aeb71faf35b8df45e1
Interesting Strings
Bundle IDs(6)
/AppleInternal/Library/BuildRoots/4~B_wOugB9FAmBuVfSl4ksj4uo3fBLLufOcP0cTlE/Library/Caches/com.apple.xbs/Sources/AppleFSCompression_executables/Common/ChunkCompression.cpp/AppleInternal/Library/BuildRoots/4~B_wOugB9FAmBuVfSl4ksj4uo3fBLLufOcP0cTlE/Library/Caches/com.apple.xbs/Sources/AppleFSCompression_executables/Common/commonUtilsUser.c/AppleInternal/Library/BuildRoots/4~B_wOugB9FAmBuVfSl4ksj4uo3fBLLufOcP0cTlE/Library/Caches/com.apple.xbs/Sources/AppleFSCompression_executables/Libraries/CompressData/CompressData.ccom.apple.ResourceForkcom.apple.afscexpand
File Paths(4)
/AppleInternal/Library/BuildRoots/4~B_wOugB9FAmBuVfSl4ksj4uo3fBLLufOcP0cTlE/Library/Caches/com.apple.xbs/Sources/AppleFSCompression_executables/Common/ChunkCompression.cpp/AppleInternal/Library/BuildRoots/4~B_wOugB9FAmBuVfSl4ksj4uo3fBLLufOcP0cTlE/Library/Caches/com.apple.xbs/Sources/AppleFSCompression_executables/Common/commonUtilsUser.c/AppleInternal/Library/BuildRoots/4~B_wOugB9FAmBuVfSl4ksj4uo3fBLLufOcP0cTlE/Library/Caches/com.apple.xbs/Sources/AppleFSCompression_executables/Libraries/CompressData/CompressData.c/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
telemetry(18)
<div class="submit" class="one of the most valign="top"><was established); created byCurrently, bgcolor="tabindex="disastrousAnalytics also has a><div id="</style><!-- effect ofanalyticswas takenwhere thetook overbelief inAfrikaansas far aspreventedwork witha special<fieldsetChristmasRetrieved.gif" onloadloaderOxfordsistersurvivlistenfemaleDesignsize="appealtext">levelsthankshigherforcedanimalanyoneAfricaagreedrecentPeople<br />wonderpricesturned|| {};main">inlinesundaywrap">failedcensusminutebeaconquotes150px|estateremoteemail"linkedright;signalformal1.htmlsignupprincefloat:.png" forum.AccesspaperssoundsextendHeightsliderUTF-8"& Before. WithstudioownersmanageprofitjQueryannualparamsboughtfamousgooglelongeri++) {israelsayingdecidehome">headerensurebranchpiecesblock;statedtop"><racingresize-->pacitysexualbureau.jpg" 10,000obtaintitlesamount, Inc.comedymenu" lyricstoday.indeedcounty_logo.FamilylookedMarketlse ifPlayerturkey);var forestgivingerrorsDomain}else{insertBlog</footerlogin.fasteragents<body 10px 0pragmafridayjuniordollarplacedcoversplugin5,000 page">boston.test(avatartested_countforumsschemaindex,filledsharesreaderalert(appearSubmitline">body"><div class="million peoplecontroversial concerning theargue that thegovernment anda reference totransferred todescribing the style="color:although therebest known forsubmit" name="multiplicationmore than one recognition ofCouncil of theedition of the <meta name="Entertainment away from the ;margin-right:at the time ofinvestigationsconnected withand many otheralthough it isbeginning with <span class="descendants of<span class="i align="right"</head>
URLs & Endpoints(51)
conversionabout the </p></div>integrated" lang="enPortuguesesubstituteindividualimpossiblemultimediaalmost allpx solid #apart fromsubject toin Englishcriticizedexcept forguidelinesoriginallyremarkablethe secondh2 class="<a title="(includingparametersprohibited= "http://dictionaryperceptionrevolutionfoundationpx;height:successfulsupportersmillenniumhis fatherthe "no-repeat;commercialindustrialencouragedamount of unofficialefficiencyReferencescoordinatedisclaimerexpeditiondevelopingcalculatedsimplifiedlegitimatesubstring(0" class="completelyillustratefive yearsinstrumentPublishing1" class="psychologyconfidencenumber of absence offocused onjoined thestructurespreviously></iframe>once againbut ratherimmigrantsof course,a group ofLiteratureUnlike the</a> style="display:none;"><<li><a href="http://www. type='text/javascript'> type="text" name=">Privacy Policy</a>administered by theenableSingleRequeststyle="margin:</div></div></div><><img src="http://i style="float:referred to as the total population ofin Washington, D.C. style="background-among other things,organization of theparticipated in thethe introduction ofidentified with thefictional character Oxford University misunderstanding ofThere are, however,stylesheet" href="/Columbia Universityexpanded to includeusually referred toindicating that thehave suggested thataffiliated with thecorrelation betweennumber of different></td></tr></table>Republic of Ireland$http://crl.apple.com/codesigning.crl0%http://www.apple.com/appleca/root.crl0
Network Surface
Networking Frameworks
Endpoints(78)
Hostnamething.org
HostnamegenretrucklooksValueFrame.net
HostnameLog.com
Hostnametos.org
Hostnamepeople.in
Hostnamethe.com
Urlhttp://px;
Urlhttps://was
Urlhttps://aIn
Urlhttp://);
Urlhttp://<a
Urlhttps://<div
Urlhttp://www.a
Urlhttp://An
Urlhttp://In
Hostname2Fwww.in
Hostnamew3.org
Urlhttp://i
Urlhttp://"
Urlhttp://<div
Urlhttp://www."
Hostnamewww.w3.org
Urlhttp://link
Urlhttp://w
Urlhttp://.css"
Urlhttp://ator"
Urlhttp://www.
Hostnamewww.apple.com
Hostnamecrl.apple.com
DNA Capability Vector
Location
0
Keychain
0
Network
0
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
0
System
0
Behavioral Profile
URL Endpoints
51
Telemetry Strings
18
File Paths
4
Bundle IDs
6
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 113 functions identified
Functions(113)
0x100000800sub_100000800
0x100000c34sub_100000c34
0x100000c40sub_100000c40
0x100000ec0sub_100000ec0
0x100001000sub_100001000
0x100001540sub_100001540
0x100001548sub_100001548
0x100001830sub_100001830
0x100001940sub_100001940
0x100001c2csub_100001c2c
0x100001d30sub_100001d30
0x100002114sub_100002114
0x10000215csub_10000215c
0x100002164sub_100002164
0x10000216csub_10000216c
0x1000023f8sub_1000023f8
0x100002404sub_100002404
0x100002414sub_100002414
0x100002464sub_100002464
0x100002d24sub_100002d24
Imports59 symbols from 3 dylibs
Exports1
_mh_execute_header0x0