postmulti
executablemacOS451.7 KBx86_64, arm64
System service — handles signed Apple framework communication
A dual-architecture Apple-signed executable that integrates with 9 public frameworks to perform 485 distinct functions. Initiates network communication to 6 endpoints while maintaining references to 4 file paths and 4 URLs. Contains bundle identifier and endpoint configuration data embedded in strings. Runs as a background system service without direct user interaction.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 451.7 KB
- UUID
- 57E641F6-6145-3957-BD49-FCA1C1210067
- Analyzed
- 2026-04-07T05:21:16Z
- CDHash
- 982c4d6826fcf9b0944d32f1fc33869af5d543d0941d30658defd8183d1900f2
Frameworks9
Interesting Strings
Bundle IDs(1)
File Paths(4)
Network Surface
DNA Capability Vector
Location
0
Keychain
0
Network
0
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
0
System
0
Behavioral Profile
URL Endpoints
4
Telemetry Strings
0
File Paths
4
Bundle IDs
1
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 485 functions identified
Functions(485)
0x100000890main
0x100000e58sub_100000e58
0x100000e7csub_100000e7c
0x100000ea8sub_100000ea8
0x100000f94sub_100000f94
0x1000011c8sub_1000011c8
0x1000015d8sub_1000015d8
0x100001730sub_100001730
0x1000017c0sub_1000017c0
0x100001a1csub_100001a1c
0x100001ad8sub_100001ad8
0x100001be4sub_100001be4
0x100001f04sub_100001f04
0x100001f60sub_100001f60
0x100002080sub_100002080
0x1000020fcsub_1000020fc
0x100002190sub_100002190
0x100002280sub_100002280
0x100002468sub_100002468
0x10000254csub_10000254c
Imports129 symbols from 1 dylibs
Exports495
_mh_execute_header0x0
allascii_len0x16b50
alldig0x5e74
argv_add0x5fac
argv_addn0x6054
argv_alloc0x5f04
argv_delete0x62f8
argv_free0x5ea8
argv_insert_one0x61b0
argv_replace_one0x6278
argv_sort0x5f5c
argv_split0x63bc
argv_split_append0x6530
argv_split_count0x6440
argv_splitq0x19a34
argv_splitq_append0x19bb8
argv_splitq_count0x19ac0
argv_terminate0x6128
argv_truncate0x6134
auto_clnt_access0x6684
auto_clnt_create0x6810
auto_clnt_free0x696c
auto_clnt_name0x6964
auto_clnt_recover0x65a8
balpar0x19c38
been_here0x285c
been_here_check0x29bc
been_here_check_fixed0x2a2c
been_here_fixed0x28cc
been_here_free0x281c
been_here_init0x27d0
casefoldx0x1a4b4
check_mail_conf_int0x31f4
check_mail_conf_str0x3afc
check_mail_conf_time0x3e0c
check_mail_version0x5cb0
cidr_match_endif0x6efc
cidr_match_execute0x69ec
cidr_match_parse0x6c00
cidr_match_parse_if0x6ecc
clean_env0x6f18
close_on_exec0x7110
concatenate0x71b4
conv_time0x2ae8
ctable_create0x723c
ctable_free0x754c
ctable_locate0x72dc
ctable_newcontext0x7544
ctable_refresh0x7460
ctable_walk0x75f0
dict_alloc0x82e8
dict_allow_surrogate0x297e0
dict_btree_open0x9018
dict_changed0x8240
dict_changed_name0x8138
dict_cidr_open0x853c
dict_db_cache_size0x280c8
dict_debug0x9820
dict_delete0x7a1c
dict_env_open0x9b90
dict_error0x7b90
dict_eval0x7f58
dict_fail_open0x170dc
dict_flags_mask0x82c0
dict_flags_str0x8260
dict_free0x84a4
dict_handle0x771c
dict_hash_open0x8c9c
dict_ht_open0x9d74
dict_inline_open0x1a200
dict_jmp_alloc0x8500
dict_lmdb_map_size0x280c0
dict_load_file_xt0x7bd4
dict_load_fp0x7d24
dict_lookup0x7938
dict_mapnames0xa430
dict_mapnames_extend0xa504
dict_open0xa0a8
dict_open30xa128
dict_open_extend0xa41c
dict_open_register0xa388
dict_pcre_open0x17e20
dict_pipe_open0x18ef8
dict_random_open0x192b0
dict_regexp_open0xa550
dict_register0x763c
dict_sequence0x7ac8
dict_sockmap_open0x1753c
dict_static_open0xb5a4
dict_surrogate0x171e0
dict_tcp_open0xb6dc
dict_thash_open0x16c5c
dict_type_override0xa518
dict_union_open0x19c90
dict_unix_open0xbb9c
dict_unregister0x7750
dict_update0x7870
dict_utf8_activate0x1a6bc
dict_walk0x80c8
doze0xbf9c
duplex_pipe0xc014
event_cancel_timer0xcfb0
event_disable_readwrite0xcca4
event_drain0xc1ec
event_enable_read0xc978
event_enable_write0xc7b0
event_fork0xc694
event_loop0xc320
event_request_timer0xce44
event_time0xc028
exec_command0xd084
extpar0x1a0b8
get_hostname0xd168
get_mail_conf_bool0x2fe0
get_mail_conf_bool_fn0x30ec
get_mail_conf_bool_fn_table0x31a8
get_mail_conf_bool_table0x315c
get_mail_conf_int0x3250
get_mail_conf_int20x343c
get_mail_conf_int_fn0x3514
get_mail_conf_int_fn_table0x3630
get_mail_conf_int_table0x35e4
get_mail_conf_long0x367c
get_mail_conf_long20x38b4
get_mail_conf_long_fn0x398c
get_mail_conf_long_fn_table0x3aac
get_mail_conf_long_table0x3a5c
get_mail_conf_nbool0x5980
get_mail_conf_nbool_fn0x59f0
get_mail_conf_nbool_fn_table0x5aac
get_mail_conf_nbool_table0x5a60
get_mail_conf_str0x3b88
get_mail_conf_str20x3c10
get_mail_conf_str_fn0x3cb0
get_mail_conf_str_fn_table0x3da4
get_mail_conf_str_table0x3d3c
get_mail_conf_time0x3e68
get_mail_conf_time20x3fbc
get_mail_conf_time_table0x4134
get_mail_version0x5ca4
hex_quote0xd20c
hex_unquote0xd300
host_port0xd430
hostaddr_to_sockaddr0xff60
hostname_to_sockaddr_pf0xfec0
htable_create0xd608
htable_delete0xd978
htable_enter0xd670
htable_find0xd804
htable_free0xdacc
htable_list0xdc08
htable_locate0xd8c0
htable_sequence0xdc94
htable_walk0xdb90
inet_addr_host0xdd20
inet_addr_list_append0xdf1c
inet_addr_list_free0xe144
inet_addr_list_init0xdee4
inet_addr_list_uniq0xe050
inet_addr_local0xe14c
inet_connect0xe390
inet_proto_init0xe678
inet_proto_table0x297c8
inet_windowsize0x297dc
long_name_mask_delim_opt0x10d8c
lowercase0xe9c0
mac_expand0xea20
mac_parse0xf284
mail_conf_checkdir0x2c1c
mail_conf_eval0x2f44
mail_conf_eval_once0x2f58
mail_conf_flush0x2f00
mail_conf_lookup0x2f6c
mail_conf_lookup_eval0x2f7c
mail_conf_read0x2ddc
mail_conf_suck0x2e04
mail_conf_update0x2fcc
mail_params_init0x4180
mail_parm_split0x5d80
mail_version_free0x5c68
mail_version_parse0x5af8
mail_version_stamp0x297e8
main0x890
mask_addr0xf5e4
midna_domain_cache_size0x284e8
midna_domain_suffix_to_ascii0x19940
midna_domain_suffix_to_utf80x199a4
midna_domain_to_ascii0x1955c
midna_domain_to_utf80x19758
midna_domain_transitional0x297e4
msg_cleanup0xf8a8
msg_error0xf6f0
msg_error_clear0xf8d0
msg_error_limit0xf8bc
msg_exiting0x297d4
msg_fatal0xf76c
msg_fatal_status0xf7dc
msg_info0xf668
msg_output0xf8dc
msg_panic0xf84c
msg_printf0xf95c
msg_syslog_facility0xfc80
msg_syslog_init0xfb28
msg_text0xfa50
msg_text_lock0x29b70
msg_verbose0x297d0
msg_vprintf0xf988
msg_vprintf_lock0x29b74
msg_vstream_init0xfcd8
msg_warn0xf6ac
mvect_alloc0xfdac
mvect_free0xfe80
mvect_realloc0xfe08
myaddrinfo_control0x1011c
myflock0x1015c
myfree0x104b8
mymalloc0x102dc
mymemdup0x106b8
mynetworks0x4b1c
mynetworks_host0x5038
myrand0x10730
myrealloc0x10370
mysrand0x1070c
mystrdup0x10590
mystrndup0x10610
mystrtok0x10788
mystrtokq0x107fc
name_code0x108d4
name_mask_delim_opt0x10978
netstring_except0x1112c
netstring_fflush0x11650
netstring_get0x11384
netstring_get_data0x1124c
netstring_get_length0x11140
netstring_get_terminator0x11328
netstring_memcat0x11720
netstring_memcpy0x11694
netstring_put0x113ec
netstring_put_multi0x114d0
netstring_setup0x110fc
netstring_strerror0x117ac
non_blocking0x117d4
null_format_string0x219e0
open_limit0x1187c
own_inet_addr0x5070
own_inet_addr_list0x5524
own_inet_mask_list0x5554
percentm0x11934
poll_fd0x17d20
poll_fd_bsd0x17b60
printable0x11aa4
proxy_inet_addr0x5584
proxy_inet_addr_list0x56fc
readllines0x11b18
ring_append0x11dbc
ring_detach0x11de4
ring_init0x11db4
ring_prepend0x11dd0
safe_getenv0x11df8
sane_connect0x11e44
sane_socketpair0x11eb8
set_inet_windowsize0x16bbc
set_mail_conf_bool0x30d0
set_mail_conf_int0x33c0
set_mail_conf_long0x37dc
set_mail_conf_nbool0x59ec
set_mail_conf_str0x3d38
set_mail_conf_time0x3fb8
set_mail_conf_time_int0x40b8
set_ugid0x11f58
sock_addr_cmp_addr0x12050
sock_addr_cmp_port0x120ec
sock_addr_in_loopback0x12140
sockaddr_to_hostaddr0x10004
sockaddr_to_hostname0x1007c
split_at0x121b4
split_at_right0x121d4
split_nameval0x121f4
split_qnameval0x1ad6c
str_long_name_mask_opt0x10f3c
str_name_code0x10944
str_name_mask_opt0x10bcc
strcasecmp_utf8x0x1ab78
strncasecmp_utf8x0x1ac6c
timed_connect0x12378
timed_read0x1243c
timed_write0x12528
trimblanks0x12614
unix_connect0x12660
unsafe0x127ac
update_env0x7030
util_utf8_enable0x297d8
valid_hostaddr0x129b0
valid_hostname0x12808
valid_hostport0x12e30
valid_ipv4_hostaddr0x12c9c
valid_ipv6_hostaddr0x12a60
valid_utf8_hostname0x1949c
valid_utf8_string0x1aecc
var_alias_db_map0x29808
var_bounce_service0x29810
var_bundle_rcpt0x29818
var_cleanup_service0x29820
var_command_dir0x29828
var_compat_level0x29830
var_config_dir0x29838
var_config_dirs0x29840
var_cyrus_sasl_authzid0x29848
var_daemon_dir0x29850
var_daemon_open_fatal0x29858
var_daemon_timeout0x2985c
var_data_dir0x29860
var_db_create_buf0x29868
var_db_read_buf0x2986c
var_db_type0x29870
var_debug_peer_level0x29878
var_debug_peer_list0x29880
var_default_gid0x29888
var_default_privs0x29890
var_default_uid0x29898
var_defer_service0x298a0
var_delay_max_res0x298a8
var_disable_dns0x298ac
var_disable_mime_input0x298b0
var_disable_mime_oconv0x298b4
var_dns_ncache_ttl_fix0x298b8
var_dont_remove0x298bc
var_double_bounce_sender0x298c0
var_drop_hdrs0x298c8
var_dsn_filter0x298d0
var_error_service0x298d8
var_event_drain0x298e0
var_export_environ0x298e8
var_fault_inj_code0x298f0
var_fflush_domains0x298f8
var_flock_delay0x29900
var_flock_stale0x29904
var_flock_tries0x29908
var_flush_service0x29910
var_fork_delay0x29918
var_fork_tries0x2991c
var_hash_queue_depth0x29920
var_hash_queue_names0x29928
var_header_limit0x29930
var_helpful_warnings0x29934
var_idle_limit0x29938
var_idna2003_compat0x2993c
var_import_environ0x29940
var_in_flow_delay0x29948
var_inet_interfaces0x29950
var_inet_protocols0x29958
var_inet_windowsize0x29960
var_int_filt_classes0x29968
var_ipc_idle_limit0x29970
var_ipc_timeout0x29974
var_ipc_ttl_limit0x29978
var_line_limit0x2997c
var_lmdb_map_size0x29980
var_long_queue_ids0x29988
var_mail_name0x29990
var_mail_owner0x29998
var_mail_release0x299a0
var_mail_version0x299a8
var_message_limit0x299b0
var_meta_dir0x299b8
var_mime_bound_len0x299c0
var_mime_maxdepth0x299c4
var_multi_cntrl_cmds0x297f0
var_multi_conf_dirs0x299c8
var_multi_enable0x299d0
var_multi_group0x299d8
var_multi_name0x299e0
var_multi_start_cmds0x297f8
var_multi_stop_cmds0x29800
var_multi_wrapper0x299e8
var_mydest0x299f0
var_mydomain0x299f8
var_myhostname0x29a00
var_mynetworks0x29a08
var_mynetworks_style0x29a10
var_myorigin0x29a18
var_oldlog_compat0x29a20
var_owner_gid0x29a24
var_owner_uid0x29a28
var_ownreq_special0x29a2c
var_par_dom_match0x29a30
var_pickup_service0x29a38
var_pid0x29a40
var_pid_dir0x29a48
var_proc_limit0x29a50
var_procname0x29a58
var_proxy_interfaces0x29a60
var_proxymap_service0x29a68
var_proxywrite_service0x29a70
var_queue_dir0x29a78
var_queue_service0x29a80
var_rcpt_delim0x29a88
var_relay_domains0x29a90
var_relayhost0x29a98
var_rewrite_service0x29aa0
var_server_config_dir0x29aa8
var_sgid_gid0x29ab0
var_sgid_group0x29ab8
var_shlib_dir0x29ac0
var_showq_service0x29ac8
var_smtputf8_autoclass0x29ad0
var_smtputf8_enable0x29ad8
var_soft_bounce0x29adc
var_starttime0x29ae0
var_strict_7bit_hdrs0x29ae8
var_strict_8bit_body0x29aec
var_strict_8bitmime0x29af0
var_strict_encoding0x29af4
var_strict_smtputf80x29af8
var_syslog_facility0x29b00
var_syslog_name0x29b08
var_token_limit0x29b10
var_trace_service0x29b18
var_transit_dest0x29b20
var_transit_origin0x29b28
var_trigger_timeout0x29b30
var_use_limit0x29b34
var_verify_neg_cache0x29b38
var_verify_service0x29b40
var_verp_delims0x29b48
var_verp_filter0x29b50
vbuf_get0x12f38
vbuf_print0x13128
vbuf_put0x12f8c
vbuf_read0x12fe8
vbuf_unget0x12ee4
vbuf_write0x13088
verp_delims_verify0x5904
verp_sender0x5744
vmsg_error0xf71c
vmsg_fatal0xf78c
vmsg_fatal_status0xf7fc
vmsg_info0xf69c
vmsg_panic0xf86c
vmsg_warn0xf6e0
vstream_bufstat0x15364
vstream_control0x14e70
vstream_fclose0x14b80
vstream_fdclose0x14d10
vstream_fdopen0x14910
vstream_fflush0x14a58
vstream_fopen0x149fc
vstream_fprintf0x14dbc
vstream_fpurge0x141a4
vstream_fputs0x14df8
vstream_fseek0x142b0
vstream_fstd0x28128
vstream_ftell0x14874
vstream_pclose0x159a0
vstream_peek0x15410
vstream_peek_data0x1543c
vstream_popen0x15558
vstream_printf0x14d74
vstream_vfprintf0x1533c
vstream_vprintf0x15304
vstring_alloc0x15a3c
vstring_ctl0x15ba4
vstring_export0x161dc
vstring_free0x15b6c
vstring_get0x1654c
vstring_get_bound0x16808
vstring_get_nonl0x1662c
vstring_get_nonl_bound0x16918
vstring_get_null0x16720
vstring_get_null_bound0x16a38
vstring_import0x16208
vstring_insert0x16030
vstring_memcat0x15f90
vstring_memchr0x15ffc
vstring_memcpy0x15f28
vstring_prepend0x16120
vstring_sprintf0x16288
vstring_sprintf_append0x16308
vstring_sprintf_prepend0x163b4
vstring_strcat0x15df0
vstring_strcpy0x15cb0
vstring_strncat0x15e80
vstring_strncpy0x15d44
vstring_truncate0x15c34
vstring_vsprintf0x162b4
vstring_vsprintf_append0x16368
warn_compat_break_app_dot_mydomain0x29b58
warn_compat_break_chroot0x29b5c
warn_compat_break_flush_domains0x29b60
warn_compat_break_mynetworks_style0x29b64
warn_compat_break_relay_domains0x29b68
warn_compat_break_smtputf8_enable0x29b6c
warn_fstat0x1750c
warn_lstat0x174dc
warn_stat0x174ac