Sorry I may have some timezones issue, running this new command (I have a 2 hour difference compared to the rclone logs):
log show --debug --info --end '2021-01-29 20:14:20' --start '2021-01-29 20:14:14' --timezone 0
I got:
Timestamp Thread Type Activity PID TTL
2021-01-29 18:14:16.006396+0000 0x2976c1 Default 0x0 144 0 WindowServer: (MultitouchHID) [com.apple.Multitouch:Plugin] [HID] [MT] dispatchEvent Dispatching event with 2 children, _eventMask=0x2 _childEventMask=0x2 Cancel=0 Touching=1 inRange=1
2021-01-29 18:14:16.126847+0000 0x297bde Activity 0x2405fb 17739 0 searchpartyuseragent: beaconObservationStore.verifyManualTime
2021-01-29 18:14:16.126906+0000 0x297bde Default 0x2405fb 17739 0 searchpartyuseragent: [com.apple.icloud.searchpartyd:transaction] Opened <private>
2021-01-29 18:14:16.127066+0000 0x297e67 Activity 0x2405fc 17739 0 searchpartyuseragent: (CoreTime) TMIsAutomaticTimeEnabled
2021-01-29 18:14:16.127748+0000 0x297e67 Default 0x2405fb 17739 0 searchpartyuseragent: [com.apple.icloud.searchpartyd:transaction] Closed <private>
2021-01-29 18:14:16.668603+0000 0x297d60 Default 0x0 144 0 WindowServer: (MultitouchHID) [com.apple.Multitouch:Plugin] [HID] [MT] dispatchEvent Dispatching event with 2 children, _eventMask=0x2 _childEventMask=0x2 Cancel=0 Touching=0 inRange=1
2021-01-29 18:14:17.080689+0000 0x297df5 Default 0x0 113 8 dasd: [com.apple.duetactivityscheduler:lifecycle] Attempting to suspend based on triggers: ( "com.apple.duetactivityscheduler.photospolicy.appchanged", "com.apple.das.apppolicy.appInFocus", "com.apple.das.apppolicy.appchanged" )
2021-01-29 18:14:17.080762+0000 0x297df5 Default 0x0 113 8 dasd: [com.apple.duetactivityscheduler:default] Ignoring trigger com.apple.duetactivityscheduler.photospolicy.appchanged because conditions are deteriorating
2021-01-29 18:14:17.080811+0000 0x297df5 Default 0x0 113 8 dasd: [com.apple.duetactivityscheduler:lifecycle] Evaluating 0 activities based on triggers
2021-01-29 18:14:17.240547+0000 0x4b6 Default 0x0 115 0 distnoted: [com.apple.distnoted:diagnostic] register name: org.eyebeam.SelfControl.SCSettingsValueChanged object: kCFNotificationAnyObject token: 100000000 pid: 40613
2021-01-29 18:14:17.241454+0000 0x297e6c Activity 0x2416f0 40613 0 org.eyebeam.SelfControl: (libsystem_info.dylib) Retrieve User by ID
2021-01-29 18:14:17.246556+0000 0x297e6c Default 0x0 40613 0 org.eyebeam.SelfControl: INFO: Checkup ran, no action needed.
2021-01-29 18:14:17.516874+0000 0x2972cf Default 0x0 144 0 WindowServer: (MultitouchHID) [com.apple.Multitouch:Plugin] [HID] [MT] dispatchEvent Dispatching event with 2 children, _eventMask=0x23 _childEventMask=0x22 Cancel=0 Touching=1 inRange=1
2021-01-29 18:14:17.734551+0000 0x2972cf Default 0x0 144 0 WindowServer: (MultitouchHID) [com.apple.Multitouch:Plugin] [HID] [MT] dispatchEvent Dispatching event with 2 children, _eventMask=0x42 _childEventMask=0x42 Cancel=0 Touching=0 inRange=1
2021-01-29 18:14:17.815280+0000 0x297e2b Default 0x0 0 0 kernel: (IO80211FamilyV2) LQM-WiFi:TX(F0:86:20:1C:BB:93) AC<SU MS NB NRS NA CM EX TF FFP MRET FLE> BE<589 0 0 0 0 0 0 0 0 0 0> (5001ms)
2021-01-29 18:14:17.815285+0000 0x297e2b Default 0x0 0 0 kernel: (IO80211FamilyV2) LQM-WiFi:TX(F0:86:20:1C:BB:93) AC<SU MS NB NRS NA CM EX TF FFP MRET FLE> BK<1 0 0 0 0 0 0 0 0 0 0> (5001ms)
2021-01-29 18:14:17.815289+0000 0x297e2b Default 0x0 0 0 kernel: (IO80211FamilyV2) LQM-WiFi:TX(F0:86:20:1C:BB:93) AC<SU MS NB NRS NA CM EX TF FFP MRET FLE> VI<0 0 0 0 0 0 0 0 0 0 0> (5001ms)
2021-01-29 18:14:17.815292+0000 0x297e2b Default 0x0 0 0 kernel: (IO80211FamilyV2) LQM-WiFi:TX(F0:86:20:1C:BB:93) AC<SU MS NB NRS NA CM EX TF FFP MRET FLE> VO<0 0 0 0 0 0 0 0 0 0 0> (5001ms)
2021-01-29 18:14:17.815299+0000 0x297e2b Default 0x0 0 0 kernel: (IO80211FamilyV2) LQM-WiFi:L3 Control VO TX(F0:86:20:1C:BB:93) Success=0 NoACK=0 Expired=0 OtherErr=0
2021-01-29 18:14:17.815302+0000 0x297e2b Default 0x0 0 0 kernel: (IO80211FamilyV2) LQM-WiFi:TX(FF:FF:FF:FF:FF:FF) AC<SU MS NB NRS NA CM EX TF FFP MRET FLE> BE<0 0 0 0 0 0 0 0 0 0 0> (5001ms)
2021-01-29 18:14:17.882151+0000 0x111 Default 0x0 0 0 kernel: (AppleBCMWLANCoreMac) 44 a 20MHz n CCA 18% duration: 501 congest: 95 ts: 258078
2021-01-29 18:14:18.533147+0000 0x297e70 Default 0x0 11274 0 pidinfo: proc_pidinfo flavor=9 pid=37405 arg=0 size=2352 returned 0 with errno 1
2021-01-29 18:14:18.536807+0000 0x297747 Default 0x0 40378 0 rclone: (CoreAnalytics) [com.apple.CoreAnalytics:client] Entering exit handler.
2021-01-29 18:14:18.536809+0000 0x297747 Default 0x0 40378 0 rclone: (CoreAnalytics) [com.apple.CoreAnalytics:client] Exiting exit handler.
2021-01-29 18:14:18.539019+0000 0x297644 Default 0x0 85 0 mds: [com.apple.spotlightserver:Volume] <DiskArb>BEGIN diskUnmountApprovalCallback <private>
2021-01-29 18:14:18.539026+0000 0x297644 Default 0x0 85 0 mds: [com.apple.spotlightserver:Volume] <DiskArb>END diskUnmountApprovalCallback - no volume
2021-01-29 18:14:18.540294+0000 0x297a75 Default 0x0 1258 0 Finder: (DesktopServicesPriv) [com.apple.DesktopServices:General] TNode::CFVolumeObserverCallback 2 <private>: <private> (-158)
2021-01-29 18:14:18.541073+0000 0x297308 Default 0x0 7562 30 photoanalysisd: (PhotoLibraryServices) [com.apple.photos.backend:Backend] Unmount of this disk is not interesting. Does not match <private>
2021-01-29 18:14:18.541148+0000 0x297145 Default 0x0 1436 30 photolibraryd: (PhotoLibraryServices) [com.apple.photos.backend:Backend] Unmount of this disk is not interesting. Does not match <private>
2021-01-29 18:14:18.541331+0000 0x297144 Default 0x0 7637 14 cloudphotod: [com.apple.photos.cpl:diskarbitration] Unmount of this disk is not interesting. Does not match <private>
2021-01-29 18:14:18.542131+0000 0x29756a Default 0x0 46262 30 com.apple.CloudPhotosConfiguration: (PhotoLibraryServices) [com.apple.photos.backend:Backend] Unmount of this disk is not interesting. Does not match <private>
2021-01-29 18:14:18.542533+0000 0x297e74 Default 0x0 46262 30 com.apple.CloudPhotosConfiguration: (PhotoLibraryServices) [com.apple.photos.backend:Backend] Unmount of this disk is not interesting. Does not match <private>
2021-01-29 18:14:18.542768+0000 0x297e64 Default 0x0 25395 0 DocumentPopoverViewService: (DesktopServicesPriv) [com.apple.DesktopServices:General] TNode::CFVolumeObserverCallback 2 <private>: <private> (-158)
2021-01-29 18:14:18.542973+0000 0x297d54 Default 0x0 12049 0 com.apple.appkit.xpc.openAndSavePanelService: (DesktopServicesPriv) [com.apple.DesktopServices:General] TNode::CFVolumeObserverCallback 2 <private>: <private> (-158)
2021-01-29 18:14:18.543738+0000 0x297b76 Error 0x0 40525 0 mdworker_shared: [com.apple.spotlightserver:ImportBailout] Asked to exit for Diskarb
2021-01-29 18:14:18.543964+0000 0x29768c Error 0x0 40373 0 mdworker_shared: [com.apple.spotlightserver:ImportBailout] Asked to exit for Diskarb
2021-01-29 18:14:18.544348+0000 0x297b77 Error 0x0 40524 0 mdworker_shared: [com.apple.spotlightserver:ImportBailout] Asked to exit for Diskarb
2021-01-29 18:14:18.544741+0000 0x297b79 Error 0x0 40527 0 mdworker_shared: [com.apple.spotlightserver:ImportBailout] Asked to exit for Diskarb
2021-01-29 18:14:18.555433+0000 0x6ad Default 0x0 257 0 mDNSResponder: [com.apple.mDNSResponder:Default] [R272950] DNSServiceCreateConnection STOP PID[40378](rclone)
2021-01-29 18:14:18.556824+0000 0x297e70 Default 0x0 11274 0 pidinfo: proc_pidinfo flavor=9 pid=37405 arg=0 size=2352 returned 0 with errno 1
2021-01-29 18:14:18.577724+0000 0x297bba Error 0x0 40533 0 mdworker_shared: [com.apple.spotlightserver:ImportBailout] Asked to exit for Diskarb
2021-01-29 18:14:18.577727+0000 0x297d9f Error 0x0 40607 0 mdworker_shared: [com.apple.spotlightserver:ImportBailout] Asked to exit for Diskarb
2021-01-29 18:14:18.577728+0000 0x297bc8 Error 0x0 40534 0 mdworker_shared: [com.apple.spotlightserver:ImportBailout] Asked to exit for Diskarb
2021-01-29 18:14:18.577731+0000 0x297da1 Error 0x0 40605 0 mdworker_shared: [com.apple.spotlightserver:ImportBailout] Asked to exit for Diskarb
2021-01-29 18:14:18.577732+0000 0x297da3 Error 0x0 40609 0 mdworker_shared: [com.apple.spotlightserver:ImportBailout] Asked to exit for Diskarb
2021-01-29 18:14:18.578804+0000 0x297da0 Error 0x0 40606 0 mdworker_shared: [com.apple.spotlightserver:ImportBailout] Asked to exit for Diskarb
2021-01-29 18:14:18.579712+0000 0x297da2 Error 0x0 40608 0 mdworker_shared: [com.apple.spotlightserver:ImportBailout] Asked to exit for Diskarb
2021-01-29 18:14:18.581300+0000 0x297e41 Error 0x0 40612 0 mdworker_shared: [com.apple.spotlightserver:ImportBailout] Asked to exit for Diskarb
2021-01-29 18:14:18.583118+0000 0x2972cf Default 0x0 144 0 WindowServer: (MultitouchHID) [com.apple.Multitouch:Plugin] [HID] [MT] dispatchEvent Dispatching event with 2 children, _eventMask=0x63 _childEventMask=0x62 Cancel=0 Touching=1 inRange=1
2021-01-29 18:14:18.599899+0000 0x297e71 Activity 0x23d9a4 1288 0 AXVisualSupportAgent: (SharedFileList) #SFLAPI LSSharedFileListCopySnapshot
2021-01-29 18:14:18.600283+0000 0x29710f Activity 0x229dbc 1252 0 MirrorDisplays: (SharedFileList) #SFLAPI LSSharedFileListCopySnapshot
2021-01-29 18:14:18.600673+0000 0x297e4f Activity 0x1b5acd 1988 0 TextInputMenuAgent: (SharedFileList) #SFLAPI LSSharedFileListCopySnapshot
2021-01-29 18:14:18.600800+0000 0x2970f7 Activity 0x240c51 2067 0 CoreLocationAgent: (SharedFileList) #SFLAPI LSSharedFileListCopySnapshot
2021-01-29 18:14:18.601196+0000 0x297e35 Activity 0x23d375 1974 0 Siri: (SharedFileList) #SFLAPI LSSharedFileListCopySnapshot
2021-01-29 18:14:18.601774+0000 0x2970f4 Activity 0x21fe3e 5172 0 Slack: (SharedFileList) #SFLAPI LSSharedFileListCopySnapshot
2021-01-29 18:14:18.601846+0000 0x2970d1 Activity 0x2119af 47389 0 Slack: (SharedFileList) #SFLAPI LSSharedFileListCopySnapshot
2021-01-29 18:14:18.602030+0000 0x2970cd Activity 0x2119bf 9992 0 Slack: (SharedFileList) #SFLAPI LSSharedFileListCopySnapshot
2021-01-29 18:14:18.608694+0000 0x297e85 Default 0x0 40615 0 automount: [com.apple.filesystem.autofs:automount] start
2021-01-29 18:14:18.609728+0000 0x297e85 Activity 0x241720 40615 0 automount: (CFOpenDirectory) Open a given node
2021-01-29 18:14:18.611919+0000 0x1b3a Activity 0x239ba9 1876 0 sharingd: (SharedFileList) #SFLAPI LSSharedFileListCopySnapshot
2021-01-29 18:14:18.612353+0000 0x297e85 Activity 0x241721 40615 0 automount: (CFOpenDirectory) Querying records from directories
2021-01-29 18:14:18.613321+0000 0x297c86 Default 0x241721 98 0 opendirectoryd: (PlistFile) [com.apple.opendirectoryd:session] recordtype 'automount' attribute 'dsAttrTypeStandard:MetaAutomountMap' is not indexed: performance hit
2021-01-29 18:14:18.614022+0000 0x297e85 Activity 0x241722 40615 0 automount: (CFOpenDirectory) Closing a node reference
2021-01-29 18:14:18.615039+0000 0x297e85 Activity 0x241723 40615 0 automount: (libsystem_info.dylib) Performance impact - Enumerate all FS entries
2021-01-29 18:14:18.618003+0000 0x297e85 Default 0x0 40615 0 automount: [com.apple.filesystem.autofs:automount] master map loaded
2021-01-29 18:14:18.618779+0000 0x297e85 Activity 0x241724 40615 0 automount: (CFOpenDirectory) Open a given node
2021-01-29 18:14:18.619600+0000 0x297e85 Activity 0x241725 40615 0 automount: (CFOpenDirectory) Copy subnode names for the current node
2021-01-29 18:14:18.620030+0000 0x297e85 Activity 0x241726 40615 0 automount: (CFOpenDirectory) Closing a node reference
2021-01-29 18:14:18.620961+0000 0x297e85 Default 0x0 40615 0 automount: [com.apple.filesystem.autofs:automount] finish
2021-01-29 18:14:18.627736+0000 0x27bce6 Default 0x0 53684 0 DiskUnmountWatcher: DiskUnmountWatcher: callback
2021-01-29 18:14:18.627808+0000 0x27bce6 Default 0x0 53684 0 DiskUnmountWatcher: DiskUnmountWatcher: callback find and release <private>
2021-01-29 18:14:18.628426+0000 0x27bce6 Default 0x0 53684 0 DiskUnmountWatcher: (KerberosHelper) [com.apple.KerberosHelper:KerberosHelper] NAHFindByLabelAndRelease: looking for label <private>
2021-01-29 18:14:18.628472+0000 0x297308 Default 0x0 7562 30 photoanalysisd: (PhotoLibraryServices) [com.apple.photos.backend:Backend] PLFileSystemVolumeManager: diskDisappearedCallback for <private>
2021-01-29 18:14:18.628508+0000 0x29714a Default 0x0 7638 0 deleted: [com.apple.cache_delete:daemon] Disk with (NULL) DAMediaBSDName disappeared, ignoring event.
2021-01-29 18:14:18.628594+0000 0x297308 Default 0x0 7562 30 photoanalysisd: (PhotoLibraryServices) [com.apple.photos.backend:Backend] ignoring diskDisappeared due to missing volumeUUID for <private>
2021-01-29 18:14:18.628733+0000 0x29776d Activity 0x23914b 1442 0 sharedfilelistd: VolumeManager.handleEvent
2021-01-29 18:14:18.629154+0000 0x297d2a Default 0x0 1258 0 Finder: (DesktopServicesPriv) [com.apple.DesktopServices:General] TNode::CFVolumeObserverCallback 8 <private>: <private> (-158)
2021-01-29 18:14:18.629200+0000 0x297150 Activity 0x229dcc 46259 0 storeuid: (SharedFileList) #SFLAPI LSSharedFileListCopySnapshot
2021-01-29 18:14:18.629337+0000 0x297156 Activity 0x1ddfcf 18618 0 nbagent: (SharedFileList) #SFLAPI LSSharedFileListCopySnapshot
2021-01-29 18:14:18.630037+0000 0x297d53 Default 0x0 25395 0 DocumentPopoverViewService: (DesktopServicesPriv) [com.apple.DesktopServices:General] TNode::CFVolumeObserverCallback 8 <private>: <private> (-158)
2021-01-29 18:14:18.630162+0000 0x297e65 Default 0x0 12049 0 com.apple.appkit.xpc.openAndSavePanelService: (DesktopServicesPriv) [com.apple.DesktopServices:General] TNode::CFVolumeObserverCallback 8 <private>: <private> (-158)
2021-01-29 18:14:18.630520+0000 0x297580 Activity 0x23e55a 12045 0 Preview: (SharedFileList) #SFLAPI LSSharedFileListCopySnapshot
2021-01-29 18:14:18.649562+0000 0x297e90 Activity 0x241740 40616 0 kcm: (Security) SecTrustEvaluateIfNecessary
2021-01-29 18:14:18.653258+0000 0x297e90 Activity 0x241741 40616 0 kcm: (Security) SecTrustEvaluateIfNecessary
2021-01-29 18:14:18.655683+0000 0x297e90 Default 0x0 40616 0 kcm: (Heimdal) [com.apple.Heimdal:libkrb5] Plugin AppSSOLocatePlugin_macOS is signed by Apple
2021-01-29 18:14:18.663078+0000 0x297e90 Activity 0x241742 40616 0 kcm: (Security) SecTrustEvaluateIfNecessary
2021-01-29 18:14:18.666745+0000 0x297e90 Activity 0x241743 40616 0 kcm: (Security) SecTrustEvaluateIfNecessary
2021-01-29 18:14:18.668757+0000 0x297e90 Default 0x0 40616 0 kcm: (Heimdal) [com.apple.Heimdal:libkrb5] Plugin AppSSOConfigPlugin_macOS is signed by Apple
2021-01-29 18:14:18.671085+0000 0x297e90 Activity 0x241744 40616 0 kcm: (Security) SecTrustEvaluateIfNecessary
2021-01-29 18:14:18.675175+0000 0x297e90 Activity 0x241745 40616 0 kcm: (Security) SecTrustEvaluateIfNecessary
2021-01-29 18:14:18.677305+0000 0x297e90 Default 0x0 40616 0 kcm: (Heimdal) [com.apple.Heimdal:libkrb5] Plugin heimdalodpac is signed by Apple
2021-01-29 18:14:18.677673+0000 0x297119 Default 0x0 184 0 analyticsd: [com.apple.analyticsd:xpc] Setting new client connection handler. 275 active connections
2021-01-29 18:14:18.677880+0000 0x297e93 Default 0x0 40616 0 kcm: (CoreAnalytics) [com.apple.CoreAnalytics:client] Received configuration update from daemon (initial)
2021-01-29 18:14:18.678037+0000 0x297e87 Activity 0x241530 1258 0 Finder: (SharedFileList) GenericList.resolveItemWithIdentifier
2021-01-29 18:14:18.678052+0000 0x297e87 Default 0x241530 1258 0 Finder: (SharedFileList) [com.apple.sharedfilelist:XPC] Resolve item 541A0B26-39CC-4FDF-89C1-34F6E546FD1F, options: 768, list: com.apple.LSSharedFileList.FavoriteItems
2021-01-29 18:14:18.678408+0000 0x297e87 Default 0x241530 1258 0 Finder: (SharedFileList) [com.apple.sharedfilelist:XPC] received: com.apple.LSSharedFileList.FavoriteItems
2021-01-29 18:14:18.679673+0000 0x297e90 Activity 0x241746 40616 0 kcm: (Security) SecTrustEvaluateIfNecessary
2021-01-29 18:14:18.683507+0000 0x297e90 Activity 0x241747 40616 0 kcm: (Security) SecTrustEvaluateIfNecessary
2021-01-29 18:14:18.686010+0000 0x297e90 Default 0x0 40616 0 kcm: (Heimdal) [com.apple.Heimdal:libkrb5] Plugin Reachability is signed by Apple
2021-01-29 18:14:18.689276+0000 0x297e90 Activity 0x241748 40616 0 kcm: (Security) SecTrustEvaluateIfNecessary
2021-01-29 18:14:18.692782+0000 0x297e90 Activity 0x241749 40616 0 kcm: (Security) SecTrustEvaluateIfNecessary
2021-01-29 18:14:18.695135+0000 0x297e90 Default 0x0 40616 0 kcm: (Heimdal) [com.apple.Heimdal:libkrb5] Plugin SCKerberosConfig is signed by Apple
2021-01-29 18:14:18.736978+0000 0x297dcb Default 0x0 65670 0 Activity Monitor: (GPUWrangler) [com.apple.GPUWrangler:default] (reg) gpu 0x56ff flags 0x10 (IG) vid.did=8086.3ea5 b:d:f=0:2:0
gpu 0x56ff pci 0x100000225 IOService:/AppleACPIPlatformExpert/PCI0@0/AppleACPIPCI/IGPU@2
gpu 0x56ff agdc 0x100000582 /AppleIntelFramebufferController/IntelFBClientControl
gpu 0x56ff gpuc 0x000000000
gpu 0x56ff agdpclient 0x1000005a1 /AppleIntelFramebufferController/IntelFBClientControl/AppleGraphicsDevicePolicy/AGDPClientControl
gpu 0x56ff accel 0x10000056a /IntelAccelerator
gpu 0x56ff fb0:0 0x100000576 /AppleIntelFramebuffer@0
gpu 0x56ff fb1:1 0x100000577 /AppleIntelFramebuffer@1
gpu 0x56ff fb2:2 0x100000578 /AppleIntelFramebuffer@2
2021-01-29 18:14:18.740343+0000 0x297d2a Activity 0x241531 1258 0 Finder: (CoreServicesInternal) CFURLCreateBookmarkData
2021-01-29 18:14:19.140561+0000 0x2972cf Default 0x0 144 0 WindowServer: (MultitouchHID) [com.apple.Multitouch:Plugin] [HID] [MT] dispatchEvent Dispatching event with 2 children, _eventMask=0x42 _childEventMask=0x42 Cancel=0 Touching=0 inRange=1
2021-01-29 18:14:19.178613+0000 0x297e87 Activity 0x241532 1258 0 Finder: (SharedFileList) GenericList.resolveItemWithIdentifier
2021-01-29 18:14:19.178644+0000 0x297e87 Default 0x241532 1258 0 Finder: (SharedFileList) [com.apple.sharedfilelist:XPC] Resolve item 541A0B26-39CC-4FDF-89C1-34F6E546FD1F, options: 768, list: com.apple.LSSharedFileList.FavoriteItems
2021-01-29 18:14:19.179668+0000 0x297e87 Default 0x241532 1258 0 Finder: (SharedFileList) [com.apple.sharedfilelist:XPC] received: com.apple.LSSharedFileList.FavoriteItems
2021-01-29 18:14:19.285949+0000 0x297d60 Default 0x0 144 0 WindowServer: (MultitouchHID) [com.apple.Multitouch:Plugin] [HID] [MT] dispatchEvent Dispatching event with 2 children, _eventMask=0x63 _childEventMask=0x62 Cancel=0 Touching=1 inRange=1
2021-01-29 18:14:19.511949+0000 0x2972cf Default 0x0 144 0 WindowServer: (MultitouchHID) [com.apple.Multitouch:Plugin] [HID] [MT] dispatchEvent Dispatching event with 2 children, _eventMask=0x42 _childEventMask=0x42 Cancel=0 Touching=0 inRange=1
2021-01-29 18:14:19.943655+0000 0x297e9f Activity 0x241750 40617 0 xpcproxy: (libsystem_info.dylib) Retrieve User by ID
2021-01-29 18:14:19.944078+0000 0x297ea0 Activity 0x241760 40618 0 xpcproxy: (libsystem_info.dylib) Retrieve User by ID
2021-01-29 18:14:19.944492+0000 0x297e9f Activity 0x241751 40617 0 xpcproxy: (libsystem_info.dylib) Resolve user group list
2021-01-29 18:14:19.944597+0000 0x297ea0 Activity 0x241761 40618 0 xpcproxy: (libsystem_info.dylib) Resolve user group list
2021-01-29 18:14:19.944892+0000 0x297e9f Activity 0x241752 40617 0 xpcproxy: (libsystem_info.dylib) Membership API: translate identifier
2021-01-29 18:14:19.944953+0000 0x297ea0 Activity 0x241762 40618 0 xpcproxy: (libsystem_info.dylib) Membership API: translate identifier
2021-01-29 18:14:19.953070+0000 0x297ea2 Activity 0x241770 40617 0 mdworker_shared: (libsystem_info.dylib) Retrieve User by ID
2021-01-29 18:14:19.953094+0000 0x297ea1 Activity 0x241780 40618 0 mdworker_shared: (libsystem_info.dylib) Retrieve User by ID
2021-01-29 18:14:19.955717+0000 0x21c2c6 Activity 0x241611 71624 0 com.avast.fileshield: (Security) SecTrustEvaluateIfNecessary
2021-01-29 18:14:19.958434+0000 0x21c2c6 Activity 0x241612 71624 0 com.avast.fileshield: (Security) SecTrustEvaluateIfNecessary
2021-01-29 18:14:19.987504+0000 0x297ea4 Activity 0x241781 40618 0 mdworker_shared: (libsystem_info.dylib) Membership API: translate identifier
2021-01-29 18:14:19.987661+0000 0x297ea3 Activity 0x241771 40617 0 mdworker_shared: (libsystem_info.dylib) Membership API: translate identifier
Where we can see some calls to DiskUnmount which are suspicious.