@Esquared
This is the log of suspicious activity. Don't have the full log for the night, but it seems like it's going on in cycles. Any thought?
8/6/16 4:16:19.000 AM kernel[0]: Wake reason: EC.DarkPME (Maintenance)
8/6/16 4:16:19.000 AM kernel[0]: AppleCamIn::systemWakeCall - messageType = 0xE0000340
8/6/16 4:16:19.000 AM kernel[0]: AppleCamIn::wakeEventHandlerThread
8/6/16 4:16:19.000 AM kernel[0]: Previous sleep cause: 5
8/6/16 4:16:19.000 AM kernel[0]: Previous shutdown cause: 5
8/6/16 4:16:19.000 AM kernel[0]: AppleThunderboltNHIType2::prePCIWake - power up complete - took 2 us
8/6/16 4:16:19.000 AM kernel[0]: AppleThunderboltGenericHAL::earlyWake - complete - took 2 milliseconds
8/6/16 4:16:19.000 AM kernel[0]: IOThunderboltSwitch<0>(0x0)::listenerCallback - Thunderbolt HPD packet for route = 0x0 port = 11 unplug = 0
8/6/16 4:16:19.000 AM kernel[0]: IOThunderboltSwitch<0>(0x0)::listenerCallback - Thunderbolt HPD packet for route = 0x0 port = 12 unplug = 0
8/6/16 4:16:19.000 AM kernel[0]: TBT W (2): 0x0040 [x]
8/6/16 4:16:19.150 AM blued[85]: Host controller terminated
8/6/16 4:16:19.000 AM kernel[0]: en0: channel changed to 1
8/6/16 4:16:19.000 AM kernel[0]: AirPort: Link Up on awdl0
8/6/16 4:16:19.000 AM kernel[0]: USBF: 15234.443 IOUSBHIDDriver(AppleUSBTCKeyboard)::RearmInterruptRead returning error 0xe00002d8 (device is not ready), not issuing any reads to device
8/6/16 4:16:19.000 AM kernel[0]: USBF: 15234.444 IOUSBHIDDriver(AppleUSBMultitouchDriver)::RearmInterruptRead returning error 0xe00002d8 (device is not ready), not issuing any reads to device
8/6/16 4:16:19.369 AM UserEventAgent[43]: Captive: CNPluginHandler en0: Inactive
8/6/16 4:16:19.370 AM configd[52]: network changed: v4(en0-:192.168.1.10) DNS- Proxy-
8/6/16 4:16:19.384 AM mDNSResponder[90]: mDNS_RegisterInterface: Frequent transitions for interface awdl0 (FE80:0000:0000:0000:A468:36FF:FE69:EF56)
8/6/16 4:16:19.389 AM mDNSResponder[90]: mDNS_RegisterInterface: Frequent transitions for interface en0 (FE80:0000:0000:0000:6203:08FF:FEA6:7570)
8/6/16 4:16:19.000 AM kernel[0]: in6_unlink_ifa: IPv6 address 0x18ed6905272df657 has no prefix
8/6/16 4:16:19.424 AM mDNSResponder[90]: mDNS_DeregisterInterface: Frequent transitions for interface en0 (FE80:0000:0000:0000:6203:08FF:FEA6:7570)
8/6/16 4:16:19.000 AM kernel[0]: AppleUSBMultitouchDriver::checkStatus - received Status Packet, Payload 2: device was reinitialized
8/6/16 4:16:19.000 AM kernel[0]: USBMSC Identifier (non-unique): 000000000820 0x5ac 0x8406 0x820, 3
8/6/16 4:16:19.000 AM kernel[0]: ARPT: 15235.044151: AirPort_Brcm43xx::powerChange: System Wake - Full Wake/ Dark Wake / Maintenance wake
8/6/16 4:16:19.000 AM kernel[0]: ARPT: 15235.044222: IOPMPowerSource Information: onWake, SleepType: Standby, 'ExternalConnected': No, 'TimeRemaining': 14,
8/6/16 4:16:19.000 AM kernel[0]: ARPT: 15235.044354: AirPort_Brcm43xx::platformWoWEnable: WWEN[disable]
8/6/16 4:16:19.000 AM kernel[0]: AppleCamIn::systemWakeCall - messageType = 0xE0000340
8/6/16 4:16:19.000 AM kernel[0]: AppleCamIn::wakeEventHandlerThread
8/6/16 4:16:19.961 AM symptomsd[197]: -[NetworkAnalyticsEngine _writeJournalRecord:fromCellFingerprint:key:atLOI:ofKind:lqm:isFaulty:] Hashing of the primary key failed. Dropping the journal record.
8/6/16 4:16:20.000 AM kernel[0]: IOBluetoothUSBDFU::probe
8/6/16 4:16:20.000 AM kernel[0]: IOBluetoothUSBDFU::probe avoid Bluetooth automatic firmware update because USB Bluetooth active
8/6/16 4:16:20.000 AM kernel[0]: **** [IOBluetoothHostControllerUSBTransport][start] -- completed -- result = TRUE -- 0xd000 ****
8/6/16 4:16:20.000 AM kernel[0]: **** [BroadcomBluetoothHostControllerUSBTransport][start] -- Completed (matched on Device) -- 0xd000 ****
8/6/16 4:16:20.000 AM kernel[0]: [IOBluetoothFamily][staticBluetoothTransportShowsUp] -- Received Bluetooth Controller register service notification -- 0xd000
8/6/16 4:16:20.000 AM kernel[0]: [IOBluetoothHostController::setConfigState] calling registerService
8/6/16 4:16:20.000 AM kernel[0]: **** [IOBluetoothFamily][ProcessBluetoothTransportShowsUpActionWL] -- calling IOBluetoothFamily's registerService() -- 0x43a0 -- 0xec00 -- 0xd000 ****
8/6/16 4:16:20.000 AM kernel[0]: **** [IOBluetoothFamily][ProcessBluetoothTransportShowsUpActionWL] -- Connected to the transport successfully -- 0x43a0 -- 0xec00 -- 0xd000 ****
8/6/16 4:16:20.071 AM UserEventAgent[43]: assertion failed: 15F34: com.apple.telemetry + 38574 [11D03EFC-DDB9-3D28-99E9-7127044D1725]: 0x7fc01c214110
8/6/16 4:16:20.070 AM blued[85]: INIT -- Host controller is published
8/6/16 4:16:20.085 AM blued[85]: INIT -- Host controller is published
8/6/16 4:16:20.000 AM kernel[0]: in6_unlink_ifa: IPv6 address 0x18ed6905272df8f7 has no prefix
8/6/16 4:16:20.000 AM kernel[0]: Setting BTCoex Config: enable_2G:1, profile_2g:0, enable_5G:1, profile_5G:0
8/6/16 4:16:20.309 AM networkd[166]: -[NETClientConnection effectiveBundleID] using process name apsd as bundle ID (this is expected for daemons without bundle ID
8/6/16 4:16:20.321 AM networkd[166]: -[NETClientConnection effectiveBundleID] using process name apsd as bundle ID (this is expected for daemons without bundle ID
8/6/16 4:16:20.327 AM networkd[166]: -[NETClientConnection effectiveBundleID] using process name apsd as bundle ID (this is expected for daemons without bundle ID
8/6/16 4:16:20.333 AM networkd[166]: -[NETClientConnection effectiveBundleID] using process name apsd as bundle ID (this is expected for daemons without bundle ID
8/6/16 4:16:20.551 AM networkd[166]: -[NETClientConnection effectiveBundleID] using process name apsd as bundle ID (this is expected for daemons without bundle ID
8/6/16 4:16:20.559 AM networkd[166]: -[NETClientConnection effectiveBundleID] using process name apsd as bundle ID (this is expected for daemons without bundle ID
8/6/16 4:16:20.562 AM symptomsd[197]: __73-[NetworkAnalyticsEngine observeValueForKeyPath:ofObject:change:context:]_block_invoke unexpected switch value 2
8/6/16 4:16:20.567 AM networkd[166]: -[NETClientConnection effectiveBundleID] using process name apsd as bundle ID (this is expected for daemons without bundle ID
8/6/16 4:16:20.574 AM networkd[166]: -[NETClientConnection effectiveBundleID] using process name apsd as bundle ID (this is expected for daemons without bundle ID
8/6/16 4:16:20.715 AM Dock[227]: -[UABestAppSuggestionManager notifyBestAppChanged:type:options:bundleIdentifier:activityType:dynamicIdentifi er:when:confidence:deviceName:deviceIdentifier:deviceType:] (null) UASuggestedActionType=0 (null)/(null) opts=(null) when=2016-06-07 20:16:20 +0000 confidence=1 from=(null)/(null) (UABestAppSuggestionManager.m #319)
8/6/16 4:16:20.000 AM kernel[0]: IO80211AWDLPeerManager::setAwdlOperatingMode Setting the AWDL operation mode from AUTO to SUSPENDED
8/6/16 4:16:20.000 AM kernel[0]: IO80211AWDLPeerManager::setAwdlSuspendedMode() Suspending AWDL, enterQuietMode(true)
8/6/16 4:16:20.955 AM netbiosd[1500]: network_reachability_changed : network is not reachable, netbiosd is shutting down
8/6/16 4:16:21.000 AM kernel[0]: AirPort: Link Up on en0
8/6/16 4:16:21.000 AM kernel[0]: en0: BSSID changed to 00:26:75:e1:8c:28
8/6/16 4:16:21.000 AM kernel[0]: en0: channel changed to 9
8/6/16 4:16:21.000 AM kernel[0]: en0::IO80211Interface::postMessage bssid changed
8/6/16 4:16:21.000 AM kernel[0]: AirPort: RSN handshake complete on en0
8/6/16 4:16:21.000 AM kernel[0]: Unexpected payload found for message 9, dataLen 0
8/6/16 4:16:22.064 AM mDNSResponder[90]: mDNS_RegisterInterface: Frequent transitions for interface en0 (FE80:0000:0000:0000:6203:08FF:FEA6:7570)
8/6/16 4:16:22.065 AM mDNSResponder[90]: mDNS_RegisterInterface: Frequent transitions for interface en0 (192.168.1.10)
8/6/16 4:16:22.070 AM configd[52]: network changed: DNS* Proxy
8/6/16 4:16:22.073 AM UserEventAgent[43]: Captive: [CNInfoNetworkActive:1748] en0: SSID 'NITIN1' making interface primary (cache indicates network not captive)
8/6/16 4:16:22.074 AM UserEventAgent[43]: Captive: CNPluginHandler en0: Evaluating
8/6/16 4:16:22.087 AM UserEventAgent[43]: Captive: en0: Not probing 'NITIN1' (cache indicates not captive)
8/6/16 4:16:22.090 AM configd[52]: network changed: v4(en0!:192.168.1.10) DNS+ Proxy+ SMB
8/6/16 4:16:22.094 AM UserEventAgent[43]: Captive: CNPluginHandler en0: Authenticated
8/6/16 4:16:22.157 AM symptomsd[197]: -[NetworkAnalyticsEngine _writeJournalRecord:fromCellFingerprint:key:atLOI:ofKind:lqm:isFaulty:] Hashing of the primary key failed. Dropping the journal record.
8/6/16 4:16:22.610 AM symptomsd[197]: __73-[NetworkAnalyticsEngine observeValueForKeyPath:ofObject:change:context:]_block_invoke unexpected switch value 2
8/6/16 4:16:22.692 AM SpotlightNetHelper[336]: [SLSUGGESTIONS] Missing SAP settings keys in the bag
8/6/16 4:16:22.000 AM kernel[0]: Setting BTCoex Config: enable_2G:1, profile_2g:0, enable_5G:1, profile_5G:0
8/6/16 4:16:23.010 AM SpotlightNetHelper[336]: tcp_connection_get_statistics called with null connection, dumping backtrace:
[x86_64] libnetcore-583.50.1
0 libsystem_network.dylib 0x00007fff9bf08de9 __nw_create_backtrace_string + 123
1 libsystem_network.dylib 0x00007fff9beee89a tcp_connection_get_statistics + 175
2 CFNetwork 0x00007fff92e9a8e1 _ZN15TCPIOConnection28_signalConnectionEstablishedEv + 111
3 libdispatch.dylib 0x00007fff9c37193d _dispatch_call_block_and_release + 12
4 libdispatch.dylib 0x00007fff9c36640b _dispatch_client_callout + 8
5 libdispatch.dylib 0x00007fff9c36b03b _dispatch_queue_drain + 754
6 libdispatch.dylib 0x00007fff9c371707 _dispatch_queue_invoke + 549
7 libdispatch.dylib 0x00007fff9c369d53 _dispatch_root_queue_drain + 538
8 libdispatch.dylib 0x00007fff9c369b00 _dispatch_worker_thread3 + 91
9 libsystem_pthread.dylib 0x00007fff940944de _pthread_wqthread + 1129
10 libsystem_pthread.dylib 0x00007fff94092341 start_wqthread + 13
8/6/16 4:16:23.014 AM SpotlightNetHelper[336]: [SLSUGGESTIONS] Got bag error -1003
8/6/16 4:16:23.000 AM kernel[0]: IO80211AWDLPeerManager::setAwdlOperatingMode Setting the AWDL operation mode from SUSPENDED to AUTO
8/6/16 4:16:23.000 AM kernel[0]: IO80211AWDLPeerManager::setAwdlAutoMode Resuming AWDL
8/6/16 4:16:24.000 AM kernel[0]: AppleCamIn::handleWakeEvent_gated
8/6/16 4:16:24.000 AM kernel[0]: AppleCamIn::handleWakeEvent_gated
8/6/16 4:17:06.000 AM kernel[0]: USBMSC Identifier (non-unique): 000000000820 0x5ac 0x8406 0x820, 3
8/6/16 4:17:10.567 AM mDNSResponder[90]: mDNS_DeregisterInterface: Frequent transitions for interface awdl0 (FE80:0000:0000:0000:A468:36FF:FE69:EF56)
8/6/16 4:17:10.567 AM mDNSResponder[90]: mDNS_DeregisterInterface: Frequent transitions for interface en0 (192.168.1.10)
8/6/16 4:17:13.000 AM kernel[0]: PM response took 2980 ms (53, powerd)
8/6/16 4:17:13.000 AM kernel[0]: ARPT: 15288.666201: AirPort_Brcm43xx::powerChange: System Sleep
8/6/16 4:17:13.000 AM kernel[0]: ARPT: 15288.666263: IOPMPowerSource Information: onSleep, SleepType: Standby, 'ExternalConnected': No, 'TimeRemaining': 14,
8/6/16 4:17:13.000 AM kernel[0]: ARPT: 15288.666284: wl0: powerChange: *** BONJOUR/MDNS OFFLOADS ARE NOT RUNNING.
8/6/16 4:17:13.000 AM kernel[0]: AppleCamIn::systemWakeCall - messageType = 0xE0000340
8/6/16 4:17:30.000 AM kernel[0]: hibernate image path: /var/vm/sleepimage
8/6/16 4:17:30.000 AM kernel[0]: efi pagecount 63
8/6/16 4:17:30.000 AM kernel[0]: hibernate_page_list_setall(preflight 1) start
8/6/16 4:17:30.000 AM kernel[0]: hibernate_page_list_setall time: 364 ms
8/6/16 4:17:30.000 AM kernel[0]: pages 329687, wire 186654, act 66528, inact 0, cleaned 0 spec 8, zf 11, throt 0, compr 23239, xpmapped 40000
8/6/16 4:17:30.000 AM kernel[0]: could discard act 44653 inact 741 purgeable 52 spec 7801 cleaned 0
8/6/16 4:17:30.000 AM kernel[0]: WARNING: hibernate_page_list_setall skipped 711 xpmapped pages
8/6/16 4:17:30.000 AM kernel[0]: hibernate_page_list_setall preflight pageCount 186654 est comp 47 setfile 428867584 min 1073741824
8/6/16 4:17:30.000 AM kernel[0]: AppleThunderboltNHIType2::prePCIWake - power up complete - took 2 us
8/6/16 4:17:30.000 AM kernel[0]: AppleThunderboltGenericHAL::earlyWake - complete - took 0 milliseconds
8/6/16 4:17:30.000 AM kernel[0]: kern_open_file_for_direct_io(0)
8/6/16 4:17:30.000 AM kernel[0]: kern_open_file_for_direct_io took 5 ms
8/6/16 4:17:30.000 AM kernel[0]: Opened file /var/vm/sleepimage, size 1073741824, extents 3, maxio 2000000 ssd 1
8/6/16 4:17:30.000 AM kernel[0]: polled file major 1, minor 0, blocksize 4096, pollers 5
8/6/16 4:17:30.000 AM kernel[0]: IOThunderboltSwitch<0>(0x0)::listenerCallback - Thunderbolt HPD packet for route = 0x0 port = 11 unplug = 0
8/6/16 4:17:30.000 AM kernel[0]: IOThunderboltSwitch<0>(0x0)::listenerCallback - Thunderbolt HPD packet for route = 0x0 port = 12 unplug = 0
8/6/16 4:17:30.000 AM kernel[0]: vm_compressor_flush - starting
8/6/16 4:17:30.000 AM kernel[0]: vm_compressor_flush completed - took 1475 msecs
8/6/16 4:17:30.000 AM kernel[0]: hibernate_flush_memory: buffer_cache_gc freed up 429 wired pages
8/6/16 4:17:30.000 AM kernel[0]: hibernate_alloc_pages act 44716, inact 741, anon 200, throt 0, spec 7806, wire 206950, wireinit 31046
8/6/16 4:17:30.000 AM kernel[0]: hibernate_setup(0) took 2128 ms
8/6/16 4:17:30.000 AM kernel[0]: en0: BSSID changed to 00:26:75:e1:8c:28
8/6/16 4:17:30.000 AM kernel[0]: en0: channel changed to 9
8/6/16 4:17:30.000 AM kernel[0]: AirPort: Link Down on awdl0. Reason 1 (Unspecified).
8/6/16 4:17:30.000 AM kernel[0]: ARPT: 15291.647773: wl0: leaveModulePoweredForOffloads: Wi-Fi will turn off.
8/6/16 4:17:30.000 AM kernel[0]: AirPort: Link Down on en0. Reason 8 (Disassociated because station leaving).
8/6/16 4:17:30.000 AM kernel[0]: en0::IO80211Interface::postMessage bssid changed
8/6/16 4:17:30.000 AM kernel[0]: ARPT: 15291.684050: AirPort_Brcm43xx::syncPowerState: WWEN[disabled]
8/6/16 4:17:30.000 AM kernel[0]: AppleCamIn::systemWakeCall - messageType = 0xE0000340
8/6/16 4:17:16.000 AM kernel[0]: AppleThunderboltNHIType2::waitForOk2Go2Sx - intel_rp = 1 dlla_reporting_supported = 0
8/6/16 4:17:30.000 AM kernel[0]: AppleThunderboltNHIType2::waitForOk2Go2Sx - retries = 6
8/6/16 4:17:30.000 AM kernel[0]: hibernate_page_list_setall(preflight 0) start
8/6/16 4:17:30.000 AM kernel[0]: hibernate_teardown started
8/6/16 4:17:30.000 AM kernel[0]: hibernate_teardown: wired_pages 206926, free_pages 1831074, active_pages 40000, inactive_pages 0, speculative_pages 0, cleaned_pages 0, compressor_pages 120
8/6/16 4:17:30.000 AM kernel[0]: hibernate_teardown_pmap_structs done: last_valid_compact_indx 118189
8/6/16 4:17:30.000 AM kernel[0]: hibernate_teardown: mark_as_unneeded_pages 2048, 27158, 19535
8/6/16 4:17:30.000 AM kernel[0]: hibernate_teardown completed - discarded 48741
8/6/16 4:17:30.000 AM kernel[0]: hibernate_page_list_setall time: 561 ms
8/6/16 4:17:30.000 AM kernel[0]: pages 188172, wire 134789, act 40000, inact 0, cleaned 0 spec 0, zf 0, throt 0, compr 120, xpmapped 40000
8/6/16 4:17:30.000 AM kernel[0]: did discard act 4664 inact 741 purgeable 52 spec 7806 cleaned 0
8/6/16 4:17:30.000 AM kernel[0]: WARNING: hibernate_page_list_setall skipped 711 xpmapped pages
8/6/16 4:17:30.000 AM kernel[0]: hibernate_page_list_setall found pageCount 174909
8/6/16 4:17:30.000 AM kernel[0]: IOHibernatePollerOpen, ml_get_interrupts_enabled 0
8/6/16 4:17:30.140 AM blued[85]: Host controller terminated
8/6/16 4:17:30.000 AM kernel[0]: IOHibernatePollerOpen(0)
8/6/16 4:17:30.000 AM kernel[0]: encryptStart 14020
8/6/16 4:17:30.000 AM kernel[0]: bitmap_size 0x3f508, previewSize 0x4028, writing 174558 pages @ 0x57550
8/6/16 4:17:30.000 AM kernel[0]: hibernate_rebuild started
8/6/16 4:17:30.000 AM kernel[0]: hibernate_rebuild_pmap_structs done: last_valid_compact_indx 118189
8/6/16 4:17:30.000 AM kernel[0]: hibernate_rebuild completed - took 9202021629973 msecs
8/6/16 4:17:30.000 AM kernel[0]: booter start at 1004 ms smc 0 ms, [12, 0, 0] total 319 ms, dsply 0, 0 ms, tramp 1078 ms
8/6/16 4:17:30.000 AM kernel[0]: hibernate_machine_init: state 2, image pages 134576, sum was 122d3449, imageSize 0x147a9000, image1Size 0xb56d000, conflictCount 613, nextFree 2fb
8/6/16 4:17:30.000 AM kernel[0]: hibernate_newruntime_map time: 0 ms, IOPolledFilePollersOpen(), ml_get_interrupts_enabled 0
8/6/16 4:17:30.000 AM kernel[0]: IOPolledFilePollersOpen(0) 5 ms
8/6/16 4:17:30.000 AM kernel[0]: hibernate_machine_init reading
8/6/16 4:17:30.000 AM kernel[0]: PMStats: Hibernate read took 359 ms
8/6/16 4:17:30.000 AM kernel[0]: hibernate_machine_init pagesDone 174696 sum2 4dde1d9e, time: 359 ms, disk(0x20000) 413 Mb/s, comp bytes: 50216960 time: 129 ms 369 Mb/s, crypt bytes: 153337856 time: 132 ms 1101 Mb/s
8/6/16 4:17:30.000 AM kernel[0]: Wake reason: EC.DarkPME (Maintenance)