5.0 lollipop - What kind of applications use internet on the background?

This question already has answers here:

Closed last year.

Viewed the list of applications that use Wi-FI and came across what is shown on the image below.

What it is? Virus? Instead of Google I use F-Droid. Root is there, but only Total Commander and Titanium Backup are available. Phone - Samsung Galaxy J1 Mini. Rooted, twrp. In applications "10005" does not exist. Titanium Backup was deleted 2 month ago.

After installing Dr.Web 10005 disappeared. But from 15.11.2018 to 12.12.2018 "10074" exist.

Answer

Every Android app (including system apps) is a *NIX user and is assigned a unique UID within range 10000-19999 at the time of installation or during first boot (for pre-installed apps). That's how Android enforces Discretionary Access Control on apps.

The number you showed looks like UID of some app which has been removed now. You can check UIDs of installed apps from file /data/system/packages.list. UIDs near to 10000 are usually system apps or builtin Google/OEM/vendor apps.

If you have root, you can track/control apps' internet access based on their UIDs using Linux kernel's built-in firewall netfilter, which is controlled by userspace tool iptables. AFWall+ makes use of the same.