Another question. After running netstat I found that root user do suspicious connections. Full table:
Proto Recv-Q Send-Q Local Address           Foreign Address         State       User       Inode      
tcp        0   1017 10.187.138.65:41475     76.94.214.35.bc.g:https FIN_WAIT1   root       0          
tcp6       02447232 ::ffff:10.184.83.:52196 lhr25s34-in-f4.1e:https FIN_WAIT1   root       0          
tcp6       0    196 ::ffff:10.184.83.:53778 lhr48s09-in-f5.1e:https FIN_WAIT1   root       0          
tcp6       0    164 ::ffff:10.184.83.:45244 ams16s22-in-f14.1:https FIN_WAIT1   root       0          
tcp6       0   1150 ::ffff:10.225.250:34310 ac88393aca5853df7:https LAST_ACK    root       0          
tcp6       0     32 ::ffff:10.184.83.:44118 lhr25s32-in-f14.1:https FIN_WAIT1   root       0          
tcp6       0     32 ::ffff:10.225.250:53666 lhr48s09-in-f5.1e:https FIN_WAIT1   root       0          
tcp6       0     25 ::ffff:10.32.254.:37910 cst2-189-76.cust.:https LAST_ACK    root       0          
tcp6       0      0 ::ffff:192.168.2.:34136 ac88393aca5853df7:https ESTABLISHED u0_a144    51098589   
tcp6       0     94 ::ffff:10.34.77.7:52606 lhr25s34-in-f4.1e:https FIN_WAIT1   root       0          
tcp6       0    164 ::ffff:10.184.83.:57250 mad08s04-in-f14.1:https LAST_ACK    root       0          
tcp6       0    106 ::ffff:192.168.2.:35240 ac88393aca5853df7:https FIN_WAIT1   root       0          
tcp6       0    186 ::ffff:10.184.83.:47866 lhr48s09-in-f5.1e:https FIN_WAIT1   root       0          
tcp6       0     32 ::ffff:10.225.250:48124 prg03s13-in-f14.1:https FIN_WAIT1   root       0          
tcp6       0      1 ::ffff:10.34.77.7:46332 lhr25s31-in-f14.1:https FIN_WAIT1   root       0          
tcp6       0    152 ::ffff:10.184.83.:50428 lhr25s34-in-f4.1e:https FIN_WAIT1   root       0          
tcp6       0      0 ::ffff:192.168.2.:52478 ac88393aca5853df7:https ESTABLISHED u0_a144    51099453   
tcp6       0     96 ::ffff:10.184.83.:54256 lhr25s32-in-f14.1:https FIN_WAIT1   root       0          
tcp6       0     32 ::ffff:10.225.250:48202 lhr25s32-in-f14.1:https FIN_WAIT1   root       0          
tcp6       0    106 ::ffff:192.168.2.:35236 ac88393aca5853df7:https FIN_WAIT1   root       0          
tcp6       0     32 ::ffff:10.225.250:60386 lhr25s34-in-f4.1e:https FIN_WAIT1   root       0          
tcp6       0     32 ::ffff:10.184.83.:52194 lhr25s34-in-f4.1e:https FIN_WAIT1   root       0          
tcp6       0 763032 ::ffff:10.184.83.:44726 mad08s04-in-f14.1:https FIN_WAIT1   root       0          
tcp6       0  13441 ::ffff:10.225.250:48090 ::ffff:104.18.11.:https FIN_WAIT1   root       0          
tcp6       0     32 ::ffff:10.187.138:58256 lhr48s09-in-f5.1e:https FIN_WAIT1   root       0          
udp        0      0 192.168.2.9:bootpc      192.168.2.1:bootps      ESTABLISHED network_stack 50843680
So here is Signal, one is Google Cloud (what signal using) but other two: SUPL Google and to Charter Communications Inc is from system?