tee

JSON
executablemacOS98.9 KBx86_64, arm64

System service — connects to Apple endpoints for configuration or telemetry

Executable signed by Apple that runs as a system service with embedded bundle identifier. Establishes network connections to 6 Apple-controlled endpoints, likely for fetching configuration, sending telemetry, or receiving updates. Contains 4 URL strings indicating predefined communication targets. Limited function count suggests focused, single-purpose operation. Uses only public frameworks, indicating standard system library dependencies.AI

Fingerprint

Platform
macOS
Type
executable
Arch
x86_64, arm64
Min OS
26.1.0
SDK
26.1.0
File Size
98.9 KB
UUID
D22A990F-BE8F-39EA-823B-143BF657BBF1
Analyzed
2026-04-07T05:21:12Z
CDHash
e70c57aecec8454090b8a62bcac20bfb2f9f14becd2fc6e8fffc1e0edcf62948

Interesting Strings

Network Surface

DNA Capability Vector

Location
0
Keychain
0
Network
0
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
0
System
0

Behavioral Profile

URL Endpoints
4
Telemetry Strings
0
File Paths
0
Bundle IDs
1
IOKit Constants
0
Library Functions
0

Structural HashesSHA-256

Static Libraries0 / 3 functions identified

Functions(3)

0x100000588sub_100000588
0x1000007a8sub_1000007a8
0x100000804sub_100000804

Imports12 symbols from 1 dylibs

Exports1

_mh_execute_header0x0