The reason it is showing as Avast is that all network traffic is filtered through webshield/netshield
So something else is downloading the data