AppleQEMUGuestAgent
executablemacOS269.8 KBx86_64, arm64
Security framework extension — provides cryptographic or authentication services to system components
Implements security-related functionality through Apple's Security framework extensions, enabling other system processes to perform cryptographic operations, certificate validation, or authentication. Communicates with multiple network endpoints and maintains access to private storage areas for security state or credentials. Directly interfaces with hardware or drivers to support secure operations, and registers multiple service bundle identifiers for IPC access by authorized clients.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 269.8 KB
- UUID
- 5DF0B891-DDD7-335E-A36E-316E7CF45BFC
- Analyzed
- 2026-04-09T09:37:44Z
- CDHash
- 5b0415cc003fb8883ad30196bad1306f01a28d86b198aca25662361a982d537b
Capabilities
StoragePrivate storage area access
com.apple.private.security.storage-exempt.heritable[object Object]HardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitSecuritySecurity framework extensions
/System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundationFrameworks9
Entitlements3
Interesting Strings
Bundle IDs(9)
File Paths(6)
/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit/System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation/System/Library/PrivateFrameworks/RemoteServiceDiscovery.framework/Versions/A/RemoteServiceDiscovery
Network Surface
Networking Frameworks
DNA Capability Vector
Location
0
Keychain
0
Network
0
Storage
1
Hardware
1
IPC
0
Analytics
0
Security
1
System
0
Behavioral Profile
URL Endpoints
4
Telemetry Strings
0
File Paths
6
Bundle IDs
9
IOKit Constants
0
Library Functions
3
Structural HashesSHA-256
Static Libraries3 / 74 functions identified
Identified Libraries
Functions(74)
0x100000c18sub_100000c18
0x100000c1csub_100000c1c
0x100000c20sub_100000c20
0x100000c98sub_100000c98
0x100000d18sub_100000d18
0x100000e04sub_100000e04
0x100000ec4sub_100000ec4
0x100000fb8sub_100000fb8
0x1000010a4sub_1000010a4
0x1000010e0sub_1000010e0
0x10000129csub_10000129c
0x10000145csub_10000145c
0x100001b18sub_100001b18
0x100001b88sub_100001b88
0x100002050sub_100002050
0x1000021a0sub_1000021a0
0x1000022e0sub_1000022e0
0x100002410sub_100002410
0x1000025acsub_1000025ac
0x100002634sub_100002634
Imports164 symbols from 10 dylibs
Exports1
_mh_execute_header0x0