swcd

executablemacOS581.5 KBx86_64, arm64

Apple system service — submits diagnostics and manages secure connections

Collects system analytics and telemetry data, then submits it to Apple's endpoints over encrypted network connections. Handles certificate validation and keychain access for secure communication. Implements modern networking protocols including HTTP, FTP, and DNS lookups to deliver diagnostics payloads. Exposes multiple XPC services for inter-process communication with other system components. Runs as an Apple-signed system daemon with no direct user interface.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 581.5 KB
UUID: 61FC5FED-59FB-3E4A-A85E-5FCFAA586817
Analyzed: 2026-04-09T10:06:45Z
CDHash: 14b06a7efbcf2ef81ba865094caa03ce2c24a30f017d774c87b169a0f3048ae8

Capabilities

NetworkModern networking framework (NWConnection)

/System/Library/Frameworks/Network.framework/Versions/A/Network

NetworkCore networking (HTTP, FTP, DNS)

/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork

AnalyticsApple unified analytics submission

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics

SecurityKeychain, certificates, code signing

/System/Library/Frameworks/Security.framework/Versions/A/Security

Frameworks12

CoreAnalytics Network InternationalSupport libSystem.B.dylib Security CoreServices CFNetwork Foundation SharedWebCredentials libobjc.A.dylib libc++.1.dylib CoreFoundation

Entitlements3

application-identifier com.apple.swcd

com.apple.private.security.daemon-containertrue

com.apple.rootless.storage.com.apple.swc.data-vaulttrue

Interesting Strings

Bundle IDs(35)

+com.apple.private.security.daemon-container 3com.apple.rootless.storage.com.apple.swc.data-vault <key>com.apple.private.security.daemon-container</key><key>com.apple.rootless.storage.com.apple.swc.data-vault</key><string>com.apple.compilers.llvm.clang.1_0</string>

File Paths(14)

/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation /System/Library/Frameworks/Network.framework/Versions/A/Network

telemetry(5)

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics SWCAnalyticsLogger URLSession:task:didFinishCollectingMetrics:_AnalyticsSendEventLazy v40@0:8@"NSURLSession"16@"NSURLSessionTask"24@"NSURLSessionTaskMetrics"32

URLs & Endpoints(5)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.compilers.llvm.clang.1_0</string>https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CFNetwork CoreFoundation Foundation Network

Endpoints(9)

Hostnameapp-site-association.cdn-apple.com

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostnamemacosx26.1.internal

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

API Usage

DNA Capability Vector

Location

0

Keychain

0

Network

2

Storage

0

Hardware

0

IPC

0

Analytics

1

Security

1

System

0

Behavioral Profile

URL Endpoints

5

Telemetry Strings

5

File Paths

14

Bundle IDs

35

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Code06b20dd5121b16c46124025ca2869422a7cb4f952a65c88078153624af18c079

Importsc309084f7fef5cbc939620325004643c023b44f6a8658e9a17c855b92ba9b4ec

Frameworks06cb8e790ed140c074ebe917b6cb42f1dcdd34853b28c802a5cad7699698b83d

Classes0e482246a92a2485e5f097915128060cfd945d4d3d7d6476731b95e1b11daa80

Entitlements4c1da3045c1146d4fb9c5c610c5154071670eb097b308f783242e9dd2234b4c1

Symbolse1008463e843d7dd99843eaa849bde6fde6345512fba8352f5f0effdcb7578bd

Static Libraries0 / 394 functions identified

Functions(394)

0x1000010a8sub_1000010a8

0x100001144-[SWCDownloader init]

0x10000129c-[SWCDownloader receiveSIGTERMSignal]

0x10000137csub_10000137c

0x10000138csub_10000138c

0x100001394sub_100001394

0x1000013d0sub_1000013d0

0x10000140c-[SWCDownloader downloadAASAFileForDomain:applicationIdentifier:completionHandler:]

0x1000014cc-[SWCDownloader downloadAASAFileForDomain:applicationIdentifier:downloadRoute:completionHandler:]

0x100001634-[SWCDownloader updateAASAFileForDomain:applicationIdentifier:completionHandler:]

0x1000016f4-[SWCDownloader updateAASAFileForDomain:applicationIdentifier:downloadRoute:completionHandler:]

0x10000185c-[SWCDownloader enumerateActiveAASAFileDownloadsWithBlock:]

0x10000194csub_10000194c

0x1000019e8sub_1000019e8

0x100001b24sub_100001b24

0x100001b34sub_100001b34

0x100001b3csub_100001b3c

0x100001b84-[SWCDownloader URLSession:task:didReceiveChallenge:completionHandler:]

0x10000219c-[SWCDownloader URLSession:task:willPerformHTTPRedirection:newRequest:completionHandler:]

0x1000025bc-[SWCDownloader URLSession:dataTask:didReceiveResponse:completionHandler:]

Imports220 symbols from 11 dylibs

libSystem.B.dylib76 libobjc.A.dylib32 SharedWebCredentials30 Foundation26 CoreFoundation23

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

audioclocksyncd

gamecontrollerd

gamecontrolleragentd