tailspin

executablemacOS241.0 KBx86_64, arm64

Analytics submission service — collects and transmits system diagnostics to Apple

Gathers system telemetry and diagnostic data, then submits it to Apple's unified analytics infrastructure via network endpoints. Uses private frameworks to access system information and format analytics payloads. Executes within a sandboxed environment with entitlements scoped to analytics submission only. Processes telemetry from multiple system components identified by bundle IDs and maintains telemetry state across submissions.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 241.0 KB
UUID: 408E4B19-89B1-34CD-9C75-7A2A40B2316C
Analyzed: 2026-04-07T05:21:15Z
CDHash: 6a0b3b5eb8c1689c9167fedd38003c4c54e888766bfc40bd2c0a5ffbc242c217

Capabilities

AnalyticsApple unified analytics submission

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics

Frameworks12

TailspinSymbolication CoreAnalytics ktrace SampleAnalysis CoreSymbolication libtailspin.dylib kperfdata Foundation libobjc.A.dylib libSystem.B.dylib CoreFoundation SoftLinking

Entitlements15

com.apple.logd.admintrue

com.apple.private.AppleProcessorTrace.Tracetrue

com.apple.private.kernel.get-kext-infotrue

com.apple.private.kernel.ktrace-backgroundtrue

com.apple.private.logging.diagnostictrue

com.apple.private.osanalytics.defaults.allowtrue

com.apple.private.roots-installed-read-onlytrue

com.apple.private.stackshottrue

com.apple.security.iokit-user-client-class

AppleProcessorTraceUserClient AppleHWAccessUserClient

com.apple.system-task-ports.readtrue

com.apple.tailspin.config-applytrue

com.apple.tailspin.cputracetrue

com.apple.tailspin.dump-outputtrue

com.apple.tailspin.symbolicationtrue

com.apple.trial.status.deployment-environment.allow

Interesting Strings

Bundle IDs(36)

com.apple.system-task-ports.read com.apple.tailspin.symbolication $com.apple.private.logging.diagnostic &com.apple.private.kernel.get-kext-info *com.apple.private.kernel.ktrace-background

File Paths(9)

/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation /System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics /System/Library/PrivateFrameworks/CoreSymbolication.framework/Versions/A/CoreSymbolication /System/Library/PrivateFrameworks/SampleAnalysis.framework/Versions/A/SampleAnalysis

telemetry(6)

,com.apple.private.osanalytics.defaults.allow /System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics <key>com.apple.private.osanalytics.defaults.allow</key>CoreAnalytics Event %@ payload: %@_AnalyticsSendEventLazy

URLs & Endpoints(5)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 .apple.com <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation

Endpoints(7)

Hostnameapple.com

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

DNA Capability Vector

Location

0

Keychain

0

Network

0

Storage

0

Hardware

0

IPC

0

Analytics

1

Security

0

System

0

Behavioral Profile

URL Endpoints

5

Telemetry Strings

6

File Paths

9

Bundle IDs

36

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Code5dc5a26987f39348df0682ab048fbece0b797881ba85c93949ab49129676bfa3

Imports11ad6310e24281f098c20fcb68b8bfbaa52212576c7bfa5092edb3e171c1ef55

Frameworksfff05ddb228c88d99d22495b23a5cae2a4069f8cefc41690240692c97348fa04

Classese3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Entitlements8ba98678cb1cab78291f0d1af6b0e1567a865df800b1a247ccec4eb7f9049c6f

Symbols11ad6310e24281f098c20fcb68b8bfbaa52212576c7bfa5092edb3e171c1ef55

Static Libraries0 / 123 functions identified

Functions(123)

0x100000d60sub_100000d60

0x1000012fcsub_1000012fc

0x100001428sub_100001428

0x1000014c0sub_1000014c0

0x1000014d0sub_1000014d0

0x1000014dcsub_1000014dc

0x10000152csub_10000152c

0x100001580sub_100001580

0x1000015d0sub_1000015d0

0x100001620sub_100001620

0x100001670sub_100001670

0x1000016c0sub_1000016c0

0x1000017acsub_1000017ac

0x1000017fcsub_1000017fc

0x1000018e8sub_1000018e8

0x100001938sub_100001938

0x100001a24sub_100001a24

0x100001a74sub_100001a74

0x100001b60sub_100001b60

0x100001bb0sub_100001bb0

Imports167 symbols from 10 dylibs

libSystem.B.dylib64 libtailspin.dylib48 ktrace24 libobjc.A.dylib14 CoreFoundation8

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

ReportMemoryException

IOMFB_bics_daemon