sshd-session
executablemacOS1.4 MBx86_64, arm64
System service — manages bundles and network operations with telemetry
Executable service that handles bundle identification and management across the system, with capability to access and track 66 distinct bundle identifiers. Establishes network connections to 13 endpoints while collecting telemetry data through 5 instrumentation points. Uses standard frameworks and maintains 3 entitlements to perform privileged operations. References 62 file paths and communicates with 5 external URLs or endpoints, suggesting integration with system-wide monitoring, configuration, or reporting infrastructure.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 1.4 MB
- UUID
- F65C7198-D5AA-308A-AF41-6C16DD6A7722
- Analyzed
- 2026-04-09T10:06:15Z
- CDHash
- 056b236246798229bdeb840001de2c51bcdfb4d8c30fbb4b20082ba1efb4b775
Frameworks11
Entitlements3
Interesting Strings
Bundle IDs(66)
/AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/EndpointSecurity/submit-ess-event.c/AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/addrmatch.c/AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/audit-bsm.c/AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/auth-krb5.c/AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/auth-options.c
File Paths(62)
/AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/EndpointSecurity/submit-ess-event.c/AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/addrmatch.c/AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/audit-bsm.c/AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/auth-krb5.c/AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/openssh/auth-options.c
telemetry(5)
/AppleInternal/Library/BuildRoots/4~B_wougBZKNDhlawXyB5GBudIfJHQ-TzXVelqd2Q/Library/Caches/com.apple.xbs/Sources/OpenSSH/EndpointSecurity/submit-ess-event.c2com.apple.private.endpoint-security.submit.openssh<key>com.apple.private.endpoint-security.submit.openssh</key>mm_submit_ess_eventsubmit_ess_event
Network Surface
Networking Frameworks
Endpoints(13)
HostnameOpenSSH-354.0.3
Ipv6C:E:b:c:f
Hostnameopenssh.com
Hostnamelibssh.org
Ipv4127.0.0.1
Ipv40.0.0.0
Hostnamewww.apple.com
Hostnamemacosx26.1.internal
Hostnamecrl.apple.com
DNA Capability Vector
Location
0
Keychain
0
Network
0
Storage
0
Hardware
0
IPC
0
Analytics
0
Security
0
System
0
Behavioral Profile
URL Endpoints
5
Telemetry Strings
5
File Paths
62
Bundle IDs
66
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 1088 functions identified
Functions(1088)
0x100000a40sub_100000a40
0x100000a44sub_100000a44
0x100000a68sub_100000a68
0x100000b38sub_100000b38
0x100000cd8sub_100000cd8
0x100000ce0sub_100000ce0
0x100000d94sub_100000d94
0x100000d9csub_100000d9c
0x100000dc8sub_100000dc8
0x100000df4sub_100000df4
0x100000ec0sub_100000ec0
0x1000020acsub_1000020ac
0x100002178sub_100002178
0x10000283csub_10000283c
0x1000029b4sub_1000029b4
0x100002b3csub_100002b3c
0x100002ba0sub_100002ba0
0x100002f7csub_100002f7c
0x100003124sub_100003124
0x100003410sub_100003410
Imports428 symbols from 8 dylibs
Exports1
_mh_execute_header0x0