Is an unknown process, downloading 1 GiB data in 30 minutes, necessarily suspicious?

After a fresh boot and login (Ubuntu 18.04), I left the computer on like this for about 30 minutes. When I came back, I saw on the LTE router display. that some process downloaded almost 1 GiB in that time.

I confirmed it with vnstat, but I didn't menage to find out what process has used this data.

I can't think of any application that I have, that would do this.

My questions are:

1. Can it be an innocent operating system process?
2. Is it possible to discover retroactively what process downloaded so much data? (I have only vnstat installed).

Solution 1:

nethogs enabled me to see data consumption by process name. with nethogs installed, I waited for another event of "mysterious data consumption". and found out it was freshclam process, belongs to ClamAV.

see this question:Freshclam is Using Lots of Mobile Data