AppleQEMUGuestAgent

JSON
executablemacOS269.8 KBx86_64, arm64

Security framework extension — provides cryptographic or authentication services to system components

Implements security-related functionality through Apple's Security framework extensions, enabling other system processes to perform cryptographic operations, certificate validation, or authentication. Communicates with multiple network endpoints and maintains access to private storage areas for security state or credentials. Directly interfaces with hardware or drivers to support secure operations, and registers multiple service bundle identifiers for IPC access by authorized clients.AI

Fingerprint

Platform
macOS
Type
executable
Arch
x86_64, arm64
Min OS
26.1.0
SDK
26.1.0
File Size
269.8 KB
UUID
5DF0B891-DDD7-335E-A36E-316E7CF45BFC
Analyzed
2026-04-09T09:37:44Z
CDHash
5b0415cc003fb8883ad30196bad1306f01a28d86b198aca25662361a982d537b

Interesting Strings

Network Surface

DNA Capability Vector

Location
0
Keychain
0
Network
0
Storage
1
Hardware
1
IPC
0
Analytics
0
Security
1
System
0

Behavioral Profile

URL Endpoints
4
Telemetry Strings
0
File Paths
6
Bundle IDs
9
IOKit Constants
0
Library Functions
3

Structural HashesSHA-256

Static Libraries3 / 74 functions identified

Identified Libraries

Functions(74)

0x100000c18sub_100000c18
0x100000c1csub_100000c1c
0x100000c20sub_100000c20
0x100000c98sub_100000c98
0x100000d18sub_100000d18
0x100000e04sub_100000e04
0x100000ec4sub_100000ec4
0x100000fb8sub_100000fb8
0x1000010a4sub_1000010a4
0x1000010e0sub_1000010e0
0x10000129csub_10000129c
0x10000145csub_10000145c
0x100001b18sub_100001b18
0x100001b88sub_100001b88
0x100002050sub_100002050
0x1000021a0sub_1000021a0
0x1000022e0sub_1000022e0
0x100002410sub_100002410
0x1000025acsub_1000025ac
0x100002634sub_100002634

Imports164 symbols from 10 dylibs

Exports1

_mh_execute_header0x0