Another question. After running netstat I found that root user do suspicious connections. Full table:
Proto Recv-Q Send-Q Local Address Foreign Address State User Inode
tcp 0 1017 10.187.138.65:41475 76.94.214.35.bc.g:https FIN_WAIT1 root 0
tcp6 02447232 ::ffff:10.184.83.:52196 lhr25s34-in-f4.1e:https FIN_WAIT1 root 0
tcp6 0 196 ::ffff:10.184.83.:53778 lhr48s09-in-f5.1e:https FIN_WAIT1 root 0
tcp6 0 164 ::ffff:10.184.83.:45244 ams16s22-in-f14.1:https FIN_WAIT1 root 0
tcp6 0 1150 ::ffff:10.225.250:34310 ac88393aca5853df7:https LAST_ACK root 0
tcp6 0 32 ::ffff:10.184.83.:44118 lhr25s32-in-f14.1:https FIN_WAIT1 root 0
tcp6 0 32 ::ffff:10.225.250:53666 lhr48s09-in-f5.1e:https FIN_WAIT1 root 0
tcp6 0 25 ::ffff:10.32.254.:37910 cst2-189-76.cust.:https LAST_ACK root 0
tcp6 0 0 ::ffff:192.168.2.:34136 ac88393aca5853df7:https ESTABLISHED u0_a144 51098589
tcp6 0 94 ::ffff:10.34.77.7:52606 lhr25s34-in-f4.1e:https FIN_WAIT1 root 0
tcp6 0 164 ::ffff:10.184.83.:57250 mad08s04-in-f14.1:https LAST_ACK root 0
tcp6 0 106 ::ffff:192.168.2.:35240 ac88393aca5853df7:https FIN_WAIT1 root 0
tcp6 0 186 ::ffff:10.184.83.:47866 lhr48s09-in-f5.1e:https FIN_WAIT1 root 0
tcp6 0 32 ::ffff:10.225.250:48124 prg03s13-in-f14.1:https FIN_WAIT1 root 0
tcp6 0 1 ::ffff:10.34.77.7:46332 lhr25s31-in-f14.1:https FIN_WAIT1 root 0
tcp6 0 152 ::ffff:10.184.83.:50428 lhr25s34-in-f4.1e:https FIN_WAIT1 root 0
tcp6 0 0 ::ffff:192.168.2.:52478 ac88393aca5853df7:https ESTABLISHED u0_a144 51099453
tcp6 0 96 ::ffff:10.184.83.:54256 lhr25s32-in-f14.1:https FIN_WAIT1 root 0
tcp6 0 32 ::ffff:10.225.250:48202 lhr25s32-in-f14.1:https FIN_WAIT1 root 0
tcp6 0 106 ::ffff:192.168.2.:35236 ac88393aca5853df7:https FIN_WAIT1 root 0
tcp6 0 32 ::ffff:10.225.250:60386 lhr25s34-in-f4.1e:https FIN_WAIT1 root 0
tcp6 0 32 ::ffff:10.184.83.:52194 lhr25s34-in-f4.1e:https FIN_WAIT1 root 0
tcp6 0 763032 ::ffff:10.184.83.:44726 mad08s04-in-f14.1:https FIN_WAIT1 root 0
tcp6 0 13441 ::ffff:10.225.250:48090 ::ffff:104.18.11.:https FIN_WAIT1 root 0
tcp6 0 32 ::ffff:10.187.138:58256 lhr48s09-in-f5.1e:https FIN_WAIT1 root 0
udp 0 0 192.168.2.9:bootpc 192.168.2.1:bootps ESTABLISHED network_stack 50843680
So here is Signal, one is Google Cloud (what signal using) but other two: SUPL Google and to Charter Communications Inc is from system?