lockstat
executablemacOS184.3 KBx86_64, arm64
System service — communicates with Apple infrastructure via network endpoints
Signed Apple executable that initiates outbound network connections to 6 distinct endpoints. Operates as a system-level daemon with access to private frameworks and maintains references to bundle identifiers and file paths. The 29 functions and minimal string count suggest a focused utility that handles internal system communication rather than user-facing operations. Purpose tied to remote connectivity with Apple services.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 184.3 KB
- UUID
- 709FAEE0-A4D2-3BB1-9E51-88F182339D26
- Analyzed
- 2026-04-07T05:21:17Z
- CDHash
- c4650a2fcbb3c61d32d3ff639b0af0c6bf85e34ef6e30e717cc814e95732628f
Interesting Strings
Bundle IDs(1)
File Paths(1)
Network Surface
DNA Capability Vector
Location
0
Keychain
0
Network
0
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
0
System
0
Behavioral Profile
URL Endpoints
4
Telemetry Strings
0
File Paths
1
Bundle IDs
1
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 29 functions identified
Functions(29)
0x100000698dtrace_gethrtime
0x1000006f8main
0x10000297csub_10000297c
0x100002a58fail
0x100002af4dfail
0x100002b80usage
0x100002c2cfilter_add
0x100002d58predicate_add
0x100002e60dprog_add
0x100002f20format_symbol
0x100003030lockstat_mergesort
0x100003160coalesce
0x100003260coalesce_symbol
0x1000032b8countcmp
0x1000032ectimecmp
0x10000332csitecmp_anylock
0x1000033a0site_and_count_cmp_anylock
0x100003420lockcmp_anywhere
0x100003460lock_and_count_cmp_anywhere
0x1000034a8lockcmp
Imports72 symbols from 3 dylibs
Exports1
_mh_execute_header0x0