The reason it is showing as Avast is that all network traffic is filtered through webshield/netshield

So something else is downloading the data