captiveagent
executablemacOS356.4 KBx86_64, arm64
System configuration utility — manages network settings and keychain access
Makes outgoing network connections to retrieve or verify system configuration settings, including DNS resolution and HTTP requests. Accesses the Keychain to read or manage certificates and credentials. Monitors network reachability and configuration state changes through Core networking APIs. Sends telemetry data to Apple endpoints. Interacts with multiple bundle IDs, suggesting coordination with system preferences or security frameworks.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 356.4 KB
- UUID
- 7DE9FF46-8F62-3697-A28D-918F63E8898F
- Analyzed
- 2026-04-09T09:44:33Z
- CDHash
- 75074a4c503bd134277a5e4dbaf5df5ad2e22e79a7492529de46ad554b2c6678
Capabilities
NetworkCore networking (HTTP, FTP, DNS)
/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetworkNetworkNetwork configuration and reachability
/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfigurationSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecurityFrameworks9
Entitlements3
Interesting Strings
Bundle IDs(10)
File Paths(5)
/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation/System/Library/Frameworks/Security.framework/Versions/A/Security/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
telemetry(2)
Network Surfaceentitled
Networking Frameworks
Endpoints(10)
DNA Capability Vector
Location
0
Keychain
0
Network
3
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
1
System
0
Behavioral Profile
URL Endpoints
5
Telemetry Strings
2
File Paths
5
Bundle IDs
10
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 321 functions identified
Functions(321)
0x100000e30-[CNWISPrLoginHandler initWithURLString:queue:responseHandler:]
0x100000f68-[CNWISPrLoginHandler dealloc]
0x100001010-[CNWISPrLoginHandler start:]
0x1000010f8-[CNWISPrLoginHandler handleAuthReply]
0x1000011ecsub_1000011ec
0x100001240sub_100001240
0x100001284sub_100001284
0x1000012c0-[CNWISPrLoginHandler poll]
0x100001470sub_100001470
0x100001710-[CNWISPrLoginHandler pollAfter:]
0x100001828sub_100001828
0x10000192c-[CNWISPrLoginHandler loginWithURL:data:]
0x100001c98sub_100001c98
0x100001f28-[CNWISPrLoginHandler cancel]
0x100001fa0+[CNWISPrLoginHandler sessionConfiguration]
0x100002014-[CNWISPrLoginHandler resultCodeFromError:]
0x1000020f4-[CNWISPrLoginHandler authReplyDictionary:]
0x100002160-[CNWISPrLoginHandler sendResponseCode:dictionary:]
0x1000021f0-[CNWISPrLoginHandler handleAuthenticationReply:]
0x1000024c0-[CNWISPrLoginHandler handleAuthenticationPollReply:]
Imports211 symbols from 10 dylibs
Exports1
_mh_execute_header0x0