Safari
executablemacOS186.7 KBx86_64, arm64
System diagnostic collection daemon — gathers and submits performance and fault telemetry
Collects diagnostic data including performance metrics, crash reports, and system health information from the device. Accesses the Secure Enclave to retrieve sealed keys for data integrity and submits encrypted telemetry to Apple endpoints via outgoing network connections. Maintains location awareness as a system service and stores diagnostic artifacts in private storage areas. Exposes 19 XPC services that allow other system daemons and applications to register diagnostic events and query collection status. Runs as a hardened process with keychain access and application group membership for coordinated data gathering across multiple system components.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 186.7 KB
- UUID
- 0ACC27A9-0AD7-3D06-8A0A-C5A4389E8D9E
- Analyzed
- 2026-04-09T08:28:29Z
- CDHash
- bd1ccee49855e72da24a5f0565642eabdd5d277d9d96fdad58aa404697a80557
Capabilities
LocationAccess location as a system bundle (no user prompt)
com.apple.locationd.effective_bundle[object Object]KeychainKeychain access group membership
keychain-access-groupscom.apple.cfnetworkcom.apple.safari.credit-cardscom.apple.safari.historycom.apple.ProtectedCloudStoragecom.apple.webinspectorcom.apple.passdcom.apple.sharing.safaripasswordsharingcom.apple.webkit.webauthnlockdown-identitiescom.apple.cfnetwork.testingcom.apple.password-managercom.apple.password-manager.testingcom.apple.webkit.webauthn.testingcom.apple.password-manager.website-metadatacom.apple.password-manager.website-metadata.testingcom.apple.sharing.safaripasswordsharing.testingcom.apple.password-manager.personalcom.apple.password-manager.personal.testingcom.apple.cfnetwork-recently-deletedcom.apple.cfnetwork-recently-deleted.testingcom.apple.password-manager-recently-deletedcom.apple.password-manager-recently-deleted.testingcom.apple.webkit.webauthn-recently-deletedcom.apple.webkit.webauthn-recently-deleted.testingcom.apple.password-manager.personal-recently-deletedcom.apple.password-manager.personal-recently-deleted.testingcom.apple.password-manager.generated-passwordscom.apple.password-manager.generated-passwords.testing
StoragePrivate storage area access
com.apple.private.security.storage.os_eligibility.readonly[object Object]StorageException: access additional file paths
com.apple.security.exception.files.absolute-path.read-onlyIpcRestricted application group access
com.apple.private.security.restricted-application-groupsIpcShared application group container access
com.apple.security.application-groupsIpcException: access additional Mach services
com.apple.security.exception.mach-lookup.global-nameFrameworks2
Entitlements168
com.apple.security.temporary-exception.mach-lookup.global-name
com.apple.analyticsdcom.apple.AppSSO.service-xpccom.apple.biometrickitdcom.apple.commercecom.apple.cookiedcom.apple.CrashReporterSupportHelpercom.apple.dprivacydcom.apple.imagent.desktop.authcom.apple.internal.safaricyclerdcom.apple.libquitdcom.apple.locationd.desktop.synchronouscom.apple.LORemoteUIPinServicecom.apple.networkserviceproxycom.apple.nsurlstorage-cachecom.apple.parsecdcom.apple.passd.accountcom.apple.passd.in-app-paymentcom.apple.passd.librarycom.apple.passd.paymentcom.apple.passd.payment-continuitycom.apple.PerformanceAnalysis.animationperfdcom.apple.PIPAgentcom.apple.remotedcom.apple.Safari.SafeBrowsing.Servicecom.apple.SafariBookmarksSyncAgentcom.apple.SafariCloudHistoryPushAgentcom.apple.SafariLaunchAgentcom.apple.SafariNotificationAgentcom.apple.security.syspolicycom.apple.SharedWebCredentialscom.apple.spotlight.SearchAgentcom.apple.usymptomsdcom.apple.UsageTrackingAgentcom.apple.UsageTrackingAgent.privatecom.apple.VideoSubscriberAccount.videosubscriptionsdcom.apple.webinspectorcom.apple.webinspector.debuggercom.apple.dmd.policycom.apple.AuthenticationServicesCore.AuthenticationServicesAgentcom.apple.AuthenticationServices.AutoFillcom.apple.email.maildcom.apple.translationdcom.apple.cdp.daemoncom.apple.duetactivityschedulercom.apple.proactive.PersonalizationPortrait.SocialHighlightcom.apple.sociallayerdcom.apple.generativeexperiences.availabilityServicecom.apple.coreservices.lsbestappsuggestionmanager.xpccom.apple.suggestd.urlscom.apple.security.octagoncom.apple.synapse.contentlinkingdcom.apple.synapse.link-context-servicecom.apple.appstorecomponentsd.xpccom.apple.ind.cloudfeaturescom.apple.ak.privateemail.xpccom.apple.group-activities.conversationmanagerhostcom.apple.copresence.conversationmanagerhostcom.apple.replaykit.sharingsession.notificationcom.apple.replaykit.sharingsessioncom.apple.Safari.History.Servicecom.apple.SharePlay.GroupSessionServicecom.apple.webprivacydcom.apple.chronoservicescom.apple.biome.access.usercom.apple.trial.statuscom.apple.financed.service.financestorecom.apple.WalletBlastDoorServicecom.apple.ManagedSettingsAgentcom.apple.ManagedSettingsAgent.publishercom.apple.generativeexperiences.summarizationcom.apple.sage.summarizationcom.apple.siri.uaf.servicecom.apple.mobileasset.autoassetcom.apple.mobileassetd.v2com.apple.system.opendirectoryd.apicom.apple.siri.uaf.subscription.servicecom.apple.ak.signinwithapple.xpccom.apple.AuthenticationServicesCore.AuthenticationServicesAgent.CredentialExchangecom.apple.Safari.PasswordBreachHelpercom.apple.security.kcsharingcom.apple.coreduetd.people.usercom.apple.familycircle.agentcom.apple.mdmclient.daemon.unrestrictedcom.apple.softwareupdated.OSUpdatecom.apple.softwareupdated
com.apple.security.temporary-exception.sbpl
(allow file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read-write") (home-subpath "/Library/Cookies")))(allow mach-issue-extension (require-all (extension-class "com.apple.webkit.extension.mach")))(allow file-write-create (home-literal "/Library/Caches/com.apple.Safari"))(allow file-write-create (home-literal "/Library/Cookies"))(allow file-write-create (home-literal "/Library/Safari Shared Data"))(allow file-write-create (home-literal "/Library/Web Driver"))(allow generic-issue-extension (extension-class-regex (regex-quote "com.apple.webkit.microphone")))(allow generic-issue-extension (extension-class-regex (regex-quote "com.apple.webkit.camera")))(allow qtn-user)(with-filter (extension "com.apple.safari.develop-menu") (allow network-outbound (literal "/private/var/run/usbmuxd")) (allow file-issue-extension (extension-class "com.apple.app-sandbox.read")) (allow network-outbound (regex #"com\.apple\.webinspectord_sim\.socket$")) (allow mach-lookup (global-name-regex #"^com\.apple\.CoreSimulator\.LaunchHost.*") (global-name #"com.apple.CoreSimulator.simdiskimaged")))(allow file-read* (subpath "/Library/Managed Preferences"))(allow file-read* (regex #"\.pltsuite$"))(allow file-read* (regex #"\.app(/.*)?$"))(allow file-write-xattr (xattr "com.apple.quarantine"))(allow file-read-data (home-path-ancestors "/Library/Safari/Bookmarks.plist"))(allow authorization-right-obtain (right-name "com.apple.Safari.parental-controls"))(allow file-read* file-write* (require-any (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2") (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2-shm") (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2-wal") (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2-lock") (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2-journal")))(allow distributed-notification-post)(allow user-preference-read (preference-domain "com.apple.gms.availability"))(allow user-preference-read (preference-domain "com.apple.newscore"))(allow user-preference-read user-preference-write (preference-domain "com.apple.news"))(allow file-read* (home-literal "/Library/Trial"))(allow iokit-issue-extension (require-all (extension-class "com.apple.webkit.extension.iokit")))(allow file-read* file-write* (home-literal "/Library/Preferences/com.apple.Safari.SafeBrowsing.plist"))(allow user-preference-read (preference-domain "com.apple.SafariUserAccountUpdater"))(allow file-write* (regex #"\.app(/.*)?$"))(allow user-preference-read user-preference-write (preference-domain-prefix "com.apple.Safari.WebApp"))(allow user-preference-read (preference-domain "com.apple.mdmclient"))(allow user-preference-read (preference-domain "com.apple.SoftwareUpdate"))
keychain-access-groups
com.apple.cfnetworkcom.apple.safari.credit-cardscom.apple.safari.historycom.apple.ProtectedCloudStoragecom.apple.webinspectorcom.apple.passdcom.apple.sharing.safaripasswordsharingcom.apple.webkit.webauthnlockdown-identitiescom.apple.cfnetwork.testingcom.apple.password-managercom.apple.password-manager.testingcom.apple.webkit.webauthn.testingcom.apple.password-manager.website-metadatacom.apple.password-manager.website-metadata.testingcom.apple.sharing.safaripasswordsharing.testingcom.apple.password-manager.personalcom.apple.password-manager.personal.testingcom.apple.cfnetwork-recently-deletedcom.apple.cfnetwork-recently-deleted.testingcom.apple.password-manager-recently-deletedcom.apple.password-manager-recently-deleted.testingcom.apple.webkit.webauthn-recently-deletedcom.apple.webkit.webauthn-recently-deleted.testingcom.apple.password-manager.personal-recently-deletedcom.apple.password-manager.personal-recently-deleted.testingcom.apple.password-manager.generated-passwordscom.apple.password-manager.generated-passwords.testing
Interesting Strings
Bundle IDs(643)
File Paths(51)
!/Library/Caches/com.apple.Safari/#/private/var/db/assetsubscriptiond/0(/Library/Containers/com.apple.news/Data/(allow file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read-write") (home-subpath "/Library/Cookies")))(allow file-read* file-write* (require-any (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2") (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2-shm") (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2-wal") (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2-lock") (home-literal "/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2-journal")))
telemetry(10)
Network Surfaceentitled
Endpoints(13)
Hostnamewww.apple.com
Hostnamecrl.apple.com
DNA Capability Vector
Location
1
Keychain
2
Network
1
Storage
5
Hardware
0
IPC
3
Analytics
1
Security
1
System
0
Behavioral Profile
URL Endpoints
6
Telemetry Strings
10
File Paths
51
Bundle IDs
643
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 1 functions identified
Functions(1)
0x100000688sub_100000688
Imports1 symbols from 1 dylibs
Exports1
_mh_execute_header0x0