postdrop
executablemacOS555.7 KBx86_64, arm64
System utility — performs configuration or diagnostic operations
Apple-signed executable that communicates with multiple network endpoints and collects telemetry data. Operates across x86_64 and ARM64 architectures. Interacts with system frameworks and manages file I/O operations across four distinct paths. Contains instrumentation for metrics collection and reporting, likely transmitting diagnostic or usage information to Apple infrastructure.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 555.7 KB
- UUID
- 92F1CD77-BDC5-34EF-BF1A-3759564E3251
- Analyzed
- 2026-04-07T05:21:12Z
- CDHash
- 6bf0f2cae04ca7d61dda9f2204bf0405effc996f613dc70e7c7665a870d12a4a
Frameworks9
Interesting Strings
Bundle IDs(1)
File Paths(4)
Network Surface
DNA Capability Vector
Location
0
Keychain
0
Network
0
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
0
System
0
Behavioral Profile
URL Endpoints
4
Telemetry Strings
3
File Paths
4
Bundle IDs
1
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 614 functions identified
Functions(614)
0x100000890main
0x100001060sub_100001060
0x1000010d8sub_1000010d8
0x1000010e0been_here_init
0x10000112cbeen_here_free
0x10000116cbeen_here
0x1000011dcbeen_here_fixed
0x1000012ccbeen_here_check
0x10000133cbeen_here_check_fixed
0x1000013f8cfg_parser_alloc
0x10000152csub_10000152c
0x1000015f0sub_1000015f0
0x100001700sub_100001700
0x100001794sub_100001794
0x10000182csub_10000182c
0x1000018c4sub_1000018c4
0x100001944cfg_get_str
0x1000019f4cfg_get_int
0x100001a68cfg_get_bool
0x100001af4cfg_parser_free
Imports172 symbols from 1 dylibs
Exports598
REMOVE0x8b68
_mh_execute_header0x0
allascii_len0x217b4
alldig0xd670
argv_add0xd7a8
argv_addn0xd850
argv_alloc0xd700
argv_delete0xdaf4
argv_free0xd6a4
argv_insert_one0xd9ac
argv_replace_one0xda74
argv_sort0xd758
argv_split0xdbb8
argv_split_append0xdd2c
argv_split_count0xdc3c
argv_splitq0x24698
argv_splitq_append0x2481c
argv_splitq_count0x24724
argv_terminate0xd924
argv_truncate0xd930
attr_print00xe204
attr_scan00xe950
attr_scan_more00xe97c
attr_vprint00xdda4
attr_vscan00xe230
auto_clnt_access0xeb5c
auto_clnt_create0xece8
auto_clnt_free0xee44
auto_clnt_name0xee3c
auto_clnt_recover0xea80
balpar0x2489c
base64_decode0xf16c
base64_decode_opt0xf174
base64_encode0xeec4
base64_encode_opt0xeecc
been_here0x116c
been_here_check0x12cc
been_here_check_fixed0x133c
been_here_fixed0x11dc
been_here_free0x112c
been_here_init0x10e0
binhash_create0xf394
binhash_delete0xf74c
binhash_enter0xf3f8
binhash_find0xf5b0
binhash_free0xf8b0
binhash_list0xf9d8
binhash_locate0xf680
binhash_walk0xf960
casefoldx0x25118
cfg_get_bool0x1a68
cfg_get_int0x19f4
cfg_get_str0x1944
cfg_parser_alloc0x13f8
cfg_parser_free0x1af4
check_mail_conf_int0x40a8
check_mail_conf_str0x49b0
check_mail_conf_time0x4cc0
check_mail_version0xa57c
check_user_acl_byuid0x8cc4
cidr_match_endif0xff74
cidr_match_execute0xfa64
cidr_match_parse0xfc78
cidr_match_parse_if0xff44
clean_env0xff90
clnt_stream_access0x1c34
clnt_stream_create0x1d8c
clnt_stream_free0x1df8
clnt_stream_recover0x1b7c
close_on_exec0x10188
concatenate0x1022c
conv_time0x1e80
ctable_create0x102b4
ctable_free0x105c4
ctable_locate0x10354
ctable_newcontext0x105bc
ctable_refresh0x104d8
ctable_walk0x10668
db_common_alloc0x1fb4
db_common_check_domain0x2828
db_common_dict_partial0x2214
db_common_expand0x225c
db_common_free_ctx0x221c
db_common_parse0x1fe4
db_common_parse_domain0x2158
db_common_sql_build_query0x28a8
dict_alloc0x11360
dict_allow_surrogate0x35940
dict_btree_open0x12090
dict_changed0x112b8
dict_changed_name0x111b0
dict_cidr_open0x115b4
dict_db_cache_size0x34010
dict_debug0x12898
dict_delete0x10a94
dict_env_open0x12c08
dict_error0x10c08
dict_eval0x10fd0
dict_fail_open0x21d40
dict_flags_mask0x11338
dict_flags_str0x112d8
dict_free0x1151c
dict_handle0x10794
dict_hash_open0x11d14
dict_ht_open0x12dec
dict_inline_open0x24e64
dict_jmp_alloc0x11578
dict_ldap_open0xac6c
dict_lmdb_map_size0x34008
dict_load_file_xt0x10c4c
dict_load_fp0x10d9c
dict_lookup0x109b0
dict_mapnames0x134a8
dict_mapnames_extend0x1357c
dict_memcache_open0x94d8
dict_open0x13120
dict_open30x131a0
dict_open_extend0x13494
dict_open_register0x13400
dict_pcre_open0x22a84
dict_pipe_open0x23b5c
dict_proxy_open0x2a00
dict_random_open0x23f14
dict_regexp_open0x135c8
dict_register0x106b4
dict_sequence0x10b40
dict_sockmap_open0x221a0
dict_static_open0x1461c
dict_surrogate0x21e44
dict_tcp_open0x14754
dict_thash_open0x218c0
dict_type_override0x13590
dict_union_open0x248f4
dict_unix_open0x14c14
dict_unregister0x107c8
dict_update0x108e8
dict_utf8_activate0x25320
dict_walk0x11140
dir_forest0x15014
doze0x151d0
duplex_pipe0x15248
event_cancel_timer0x161e4
event_disable_readwrite0x15ed8
event_drain0x15420
event_enable_read0x15bac
event_enable_write0x159e4
event_fork0x158c8
event_loop0x15554
event_request_timer0x16078
event_time0x1525c
exec_command0x162b8
extpar0x24d1c
fifo_trigger0x1639c
get_file_id0x39cc
get_file_id_fd0x39d4
get_file_id_st0x3a38
get_file_limit0x164e4
get_hostname0x1658c
get_mail_conf_bool0x3e94
get_mail_conf_bool_fn0x3fa0
get_mail_conf_bool_fn_table0x405c
get_mail_conf_bool_table0x4010
get_mail_conf_int0x4104
get_mail_conf_int20x42f0
get_mail_conf_int_fn0x43c8
get_mail_conf_int_fn_table0x44e4
get_mail_conf_int_table0x4498
get_mail_conf_long0x4530
get_mail_conf_long20x4768
get_mail_conf_long_fn0x4840
get_mail_conf_long_fn_table0x4960
get_mail_conf_long_table0x4910
get_mail_conf_nbool0x8ffc
get_mail_conf_nbool_fn0x906c
get_mail_conf_nbool_fn_table0x9128
get_mail_conf_nbool_table0x90dc
get_mail_conf_str0x4a3c
get_mail_conf_str20x4ac4
get_mail_conf_str_fn0x4b64
get_mail_conf_str_fn_table0x4c58
get_mail_conf_str_table0x4bf0
get_mail_conf_time0x4d1c
get_mail_conf_time20x4e70
get_mail_conf_time_table0x4fe8
get_mail_version0xa570
hex_quote0x16630
hex_unquote0x16724
host_port0x16854
hostaddr_to_sockaddr0x1a178
hostname_to_sockaddr_pf0x1a0d8
htable_create0x16a2c
htable_delete0x16d9c
htable_enter0x16a94
htable_find0x16c28
htable_free0x16ef0
htable_list0x1702c
htable_locate0x16ce4
htable_sequence0x170b8
htable_walk0x16fb4
inet_addr_host0x17144
inet_addr_list_append0x17340
inet_addr_list_free0x17568
inet_addr_list_init0x17308
inet_addr_list_uniq0x17474
inet_addr_local0x17570
inet_connect0x177b4
inet_proto_init0x17a9c
inet_proto_table0x35928
inet_windowsize0x3593c
long_name_mask_delim_opt0x1afa4
lowercase0x17de4
mac_expand0x17e44
mac_parse0x186a8
mail_conf_checkdir0x3ad0
mail_conf_eval0x3df8
mail_conf_eval_once0x3e0c
mail_conf_flush0x3db4
mail_conf_lookup0x3e20
mail_conf_lookup_eval0x3e30
mail_conf_read0x3c90
mail_conf_suck0x3cb8
mail_conf_update0x3e80
mail_connect0x5034
mail_connect_wait0x510c
mail_dict_init0x51a8
mail_params_init0x51e4
mail_parm_split0xab78
mail_pathname0x5b80
mail_queue_dir0x5bb0
mail_queue_enter0x6060
mail_queue_id_ok0x5e24
mail_queue_mkdirs0x5f08
mail_queue_name_ok0x5db8
mail_queue_open0x63c4
mail_queue_path0x5e98
mail_queue_remove0x602c
mail_queue_rename0x5f74
mail_stream_cleanup0x6470
mail_stream_command0x6a18
mail_stream_ctl0x6ba0
mail_stream_file0x6500
mail_stream_finish0x64f8
mail_stream_service0x6888
mail_task0x6e00
mail_trigger0x6ea8
mail_version_free0xa534
mail_version_parse0xa3c4
mail_version_stamp0x35948
main0x890
make_dirs0x18a08
mask_addr0x18bd0
match_hostaddr0x195fc
match_hostname0x193e0
match_list_free0x191f4
match_list_init0x18c54
match_list_match0x1907c
match_string0x19250
memcache_fread0xa8e0
memcache_fwrite0xa824
memcache_get0xa64c
memcache_printf0xaaac
memcache_vprintf0xaa68
midna_domain_cache_size0x34430
midna_domain_suffix_to_ascii0x245a4
midna_domain_suffix_to_utf80x24608
midna_domain_to_ascii0x241c0
midna_domain_to_utf80x243bc
midna_domain_transitional0x35944
msg_cleanup0x19ac0
msg_error0x19908
msg_error_clear0x19ae8
msg_error_limit0x19ad4
msg_exiting0x35934
msg_fatal0x19984
msg_fatal_status0x199f4
msg_info0x19880
msg_output0x19af4
msg_panic0x19a64
msg_printf0x19b74
msg_syslog_facility0x19e98
msg_syslog_init0x19d40
msg_text0x19c68
msg_text_lock0x35cc0
msg_verbose0x35930
msg_vprintf0x19ba0
msg_vprintf_lock0x35cc4
msg_vstream_init0x19ef0
msg_warn0x198c4
mvect_alloc0x19fc4
mvect_free0x1a098
mvect_realloc0x1a020
myaddrinfo_control0x1a334
myflock0x1a374
myfree0x1a6d0
mymalloc0x1a4f4
mymemdup0x1a8d0
mynetworks0x6fc0
mynetworks_host0x74dc
mypwfree0x76b4
mypwnam0x7890
mypwnam_err0x7914
mypwuid0x7514
mypwuid_err0x7598
myrand0x1a948
myrealloc0x1a588
mysrand0x1a924
mystrdup0x1a7a8
mystrndup0x1a828
mystrtok0x1a9a0
mystrtokq0x1aa14
name_code0x1aaec
name_mask_delim_opt0x1ab90
netstring_except0x1b344
netstring_fflush0x1b868
netstring_get0x1b59c
netstring_get_data0x1b464
netstring_get_length0x1b358
netstring_get_terminator0x1b540
netstring_memcat0x1b938
netstring_memcpy0x1b8ac
netstring_put0x1b604
netstring_put_multi0x1b6e8
netstring_setup0x1b314
netstring_strerror0x1b9c4
non_blocking0x1b9ec
null_format_string0x2ed20
off_cvt_number0x7a9c
off_cvt_string0x7a38
open_limit0x1ba94
own_inet_addr0x7be0
own_inet_addr_list0x8094
own_inet_mask_list0x80c4
percentm0x1bb4c
poll_fd0x22984
poll_fd_bsd0x227c4
postfix_basename0xf364
printable0x1bcbc
proxy_inet_addr0x80f4
proxy_inet_addr_list0x826c
readllines0x1bd30
rec_attr_map0x82b4
rec_fprintf0x8a98
rec_fputs0x8ac4
rec_get_raw0x8578
rec_goto0x88a4
rec_pad0x8b28
rec_put0x8444
rec_put_type0x835c
rec_vfprintf0x8a10
ring_append0x1bfd4
ring_detach0x1bffc
ring_init0x1bfcc
ring_prepend0x1bfe8
safe_getenv0x1c010
safe_open0x1c05c
safe_strtoul0x9318
safe_ultostr0x9174
sane_basename0x215c8
sane_connect0x1c4d0
sane_dirname0x216b4
sane_rename0x1c544
sane_socketpair0x1c5f4
set_file_limit0x16530
set_inet_windowsize0x21820
set_mail_conf_bool0x3f84
set_mail_conf_int0x4274
set_mail_conf_long0x4690
set_mail_conf_nbool0x9068
set_mail_conf_str0x4bec
set_mail_conf_time0x4e6c
set_mail_conf_time_int0x4f6c
set_ugid0x1c694
sock_addr_cmp_addr0x1c78c
sock_addr_cmp_port0x1c828
sock_addr_in_loopback0x1c87c
sockaddr_to_hostaddr0x1a21c
sockaddr_to_hostname0x1a294
split_at0x1c8f0
split_at_right0x1c910
split_nameval0x1c930
split_qnameval0x259d0
str_long_name_mask_opt0x1b154
str_name_code0x1ab5c
str_name_mask_opt0x1ade4
strcasecmp_utf8x0x257dc
strncasecmp_utf8x0x258d0
timed_connect0x1cab4
timed_ipc_setup0x8c78
timed_read0x1cb78
timed_write0x1cc64
trimblanks0x1cd50
unix_connect0x1cd9c
unix_trigger0x1cee8
unsafe0x1d10c
update_env0x100a8
util_utf8_enable0x35938
valid_hostaddr0x1d310
valid_hostname0x1d168
valid_hostport0x1d790
valid_ipv4_hostaddr0x1d5fc
valid_ipv6_hostaddr0x1d3c0
valid_utf8_hostname0x24100
valid_utf8_string0x25b30
var_alias_db_map0x35958
var_bounce_service0x35960
var_bundle_rcpt0x35968
var_cleanup_service0x35970
var_command_dir0x35978
var_compat_level0x35980
var_config_dir0x35988
var_config_dirs0x35990
var_cyrus_sasl_authzid0x35998
var_daemon_dir0x359a0
var_daemon_open_fatal0x359a8
var_daemon_timeout0x359ac
var_data_dir0x359b0
var_db_create_buf0x359b8
var_db_read_buf0x359bc
var_db_type0x359c0
var_debug_peer_level0x359c8
var_debug_peer_list0x359d0
var_default_gid0x359d8
var_default_privs0x359e0
var_default_uid0x359e8
var_defer_service0x359f0
var_delay_max_res0x359f8
var_disable_dns0x359fc
var_disable_mime_input0x35a00
var_disable_mime_oconv0x35a04
var_dns_ncache_ttl_fix0x35a08
var_dont_remove0x35a0c
var_double_bounce_sender0x35a10
var_drop_hdrs0x35a18
var_dsn_filter0x35a20
var_error_service0x35a28
var_event_drain0x35a30
var_export_environ0x35a38
var_fault_inj_code0x35a40
var_fflush_domains0x35a48
var_flock_delay0x35a50
var_flock_stale0x35a54
var_flock_tries0x35a58
var_flush_service0x35a60
var_fork_delay0x35a68
var_fork_tries0x35a6c
var_hash_queue_depth0x35a70
var_hash_queue_names0x35a78
var_header_limit0x35a80
var_helpful_warnings0x35a84
var_idle_limit0x35a88
var_idna2003_compat0x35a8c
var_import_environ0x35a90
var_in_flow_delay0x35a98
var_inet_interfaces0x35aa0
var_inet_protocols0x35aa8
var_inet_windowsize0x35ab0
var_int_filt_classes0x35ab8
var_ipc_idle_limit0x35ac0
var_ipc_timeout0x35ac4
var_ipc_ttl_limit0x35ac8
var_line_limit0x35acc
var_lmdb_map_size0x35ad0
var_long_queue_ids0x35ad8
var_mail_name0x35ae0
var_mail_owner0x35ae8
var_mail_release0x35af0
var_mail_version0x35af8
var_message_limit0x35b00
var_meta_dir0x35b08
var_mime_bound_len0x35b10
var_mime_maxdepth0x35b14
var_multi_conf_dirs0x35b18
var_multi_enable0x35b20
var_multi_group0x35b28
var_multi_name0x35b30
var_multi_wrapper0x35b38
var_mydest0x35b40
var_mydomain0x35b48
var_myhostname0x35b50
var_mynetworks0x35b58
var_mynetworks_style0x35b60
var_myorigin0x35b68
var_oldlog_compat0x35b70
var_owner_gid0x35b74
var_owner_uid0x35b78
var_ownreq_special0x35b7c
var_par_dom_match0x35b80
var_pickup_service0x35b88
var_pid0x35b90
var_pid_dir0x35b98
var_proc_limit0x35ba0
var_procname0x35ba8
var_proxy_interfaces0x35bb0
var_proxymap_service0x35bb8
var_proxywrite_service0x35bc0
var_queue_dir0x35bc8
var_queue_service0x35bd0
var_rcpt_delim0x35bd8
var_relay_domains0x35be0
var_relayhost0x35be8
var_rewrite_service0x35bf0
var_server_config_dir0x35bf8
var_sgid_gid0x35c00
var_sgid_group0x35c08
var_shlib_dir0x35c10
var_showq_service0x35c18
var_smtputf8_autoclass0x35c20
var_smtputf8_enable0x35c28
var_soft_bounce0x35c2c
var_starttime0x35c30
var_strict_7bit_hdrs0x35c38
var_strict_8bit_body0x35c3c
var_strict_8bitmime0x35c40
var_strict_encoding0x35c44
var_strict_smtputf80x35c48
var_submit_acl0x35950
var_syslog_facility0x35c50
var_syslog_name0x35c58
var_token_limit0x35c60
var_trace_service0x35c68
var_transit_dest0x35c70
var_transit_origin0x35c78
var_trigger_timeout0x35c80
var_use_limit0x35c84
var_verify_neg_cache0x35c88
var_verify_service0x35c90
var_verp_delims0x35c98
var_verp_filter0x35ca0
vbuf_get0x1d898
vbuf_print0x1da88
vbuf_put0x1d8ec
vbuf_read0x1d948
vbuf_unget0x1d844
vbuf_write0x1d9e8
verp_delims_verify0x8f80
verp_sender0x8dc0
vmsg_error0x19934
vmsg_fatal0x199a4
vmsg_fatal_status0x19a14
vmsg_info0x198b4
vmsg_panic0x19a84
vmsg_warn0x198f8
vstream_bufstat0x1fcc4
vstream_control0x1f7d0
vstream_fclose0x1f4e0
vstream_fdclose0x1f670
vstream_fdopen0x1f270
vstream_fflush0x1f3b8
vstream_fopen0x1f35c
vstream_fprintf0x1f71c
vstream_fpurge0x1eb04
vstream_fputs0x1f758
vstream_fseek0x1ec10
vstream_fstd0x34070
vstream_ftell0x1f1d4
vstream_pclose0x20300
vstream_peek0x1fd70
vstream_peek_data0x1fd9c
vstream_popen0x1feb8
vstream_printf0x1f6d4
vstream_vfprintf0x1fc9c
vstream_vprintf0x1fc64
vstring_alloc0x2039c
vstring_ctl0x20504
vstring_export0x20b3c
vstring_free0x204cc
vstring_get0x20eac
vstring_get_bound0x21168
vstring_get_nonl0x20f8c
vstring_get_nonl_bound0x21278
vstring_get_null0x21080
vstring_get_null_bound0x21398
vstring_import0x20b68
vstring_insert0x20990
vstring_memcat0x208f0
vstring_memchr0x2095c
vstring_memcpy0x20888
vstring_prepend0x20a80
vstring_sprintf0x20be8
vstring_sprintf_append0x20c68
vstring_sprintf_prepend0x20d14
vstring_strcat0x20750
vstring_strcpy0x20610
vstring_strncat0x207e0
vstring_strncpy0x206a4
vstring_truncate0x20594
vstring_vsprintf0x20c14
vstring_vsprintf_append0x20cc8
warn_compat_break_app_dot_mydomain0x35ca8
warn_compat_break_chroot0x35cac
warn_compat_break_flush_domains0x35cb0
warn_compat_break_mynetworks_style0x35cb4
warn_compat_break_relay_domains0x35cb8
warn_compat_break_smtputf8_enable0x35cbc
warn_fstat0x22170
warn_lstat0x22140
warn_stat0x22110
write_buf0x214b0