Maybe evil code in all text [203 seconds]:

/home/httpd/vhosts/csgotinky.ru/.cagefs/tmp/phpd.local : /bin/psocksd 
/home/httpd/vhosts/csgotinky.ru/httpdocs/license.php : <h1>\#p\@\$c\@\#</h1 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/uploader.php : =[[:space:]]getcwd[(][)] 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/sodium_compat/namespaced/Core/ChaCha20/.h..php : =[[:space:]]getcwd[(][)] 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/sodium_compat/namespaced/Core/ChaCha20/content-post.php : =[[:space:]]getcwd[(][)] 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/sodium_compat/namespaced/Core/Curve25519/Ge/simpleside.php5 : =[[:space:]]getcwd[(][)] 
/home/httpd/vhosts/csgotinky.ru/statistics/webstat/2019-10/awstats.csgotinky.ru-http.errors404.html : [.]php[.]suspected 
/home/httpd/vhosts/csgotinky.ru/statistics/webstat/awstats102019.csgotinky.ru-http.bak : [.]php[.]suspected 
/home/httpd/vhosts/csgotinky.ru/statistics/webstat/awstats102019.csgotinky.ru-http.txt : [.]php[.]suspected 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/jarida/panel/shortcodes/ui.php : http 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/twentyfifteen/header.php : http 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/l10n.php : files = scandir 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/plugins/wp-fastest-cache-premium/pro/library/image.php : finfo_open 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/functions.php : finfo_open 
/home/httpd/vhosts/csgotinky.ru/.cl.selector/ini_menu_getETCreateNewTicket.php : foreach[(]\[[[:digit:]]+,[[:digit:]]+,[[:digit:]]+,[[:digit:]]+.*\] 
/home/httpd/vhosts/csgotinky.ru/.cl.selector/menu_getETCreateNewTicket.php : foreach[(]\[[[:digit:]]+,[[:digit:]]+,[[:digit:]]+,[[:digit:]]+.*\] 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-admin/js/widgets/admin-filters_new.php : foreach[(]\[[[:digit:]]+,[[:digit:]]+,[[:digit:]]+,[[:digit:]]+.*\] 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/plugins/adsplacer/settings_phpfunc.php : foreach[(]\[[[:digit:]]+,[[:digit:]]+,[[:digit:]]+,[[:digit:]]+.*\] 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/jarida/panel/mod_x.php : foreach[(]\[[[:digit:]]+,[[:digit:]]+,[[:digit:]]+,[[:digit:]]+.*\] 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/indx.php : foreach[(]\[[[:digit:]]+,[[:digit:]]+,[[:digit:]]+,[[:digit:]]+.*\] 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/noitems_ajax.php : foreach[(]\[[[:digit:]]+,[[:digit:]]+,[[:digit:]]+,[[:digit:]]+.*\] 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/searchform.php : foreach[(]\[[[:digit:]]+,[[:digit:]]+,[[:digit:]]+,[[:digit:]]+.*\] 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/sidebar.php : foreach[(]\[[[:digit:]]+,[[:digit:]]+,[[:digit:]]+,[[:digit:]]+.*\] 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/single.php : foreach[(]\[[[:digit:]]+,[[:digit:]]+,[[:digit:]]+,[[:digit:]]+.*\] 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/cache/all/nakopiteli/obzor-zhestkogo-diska-toshiba-n300-pervyj-hdd-toshiba-dlya-nas/index.html : goo.gl/ 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/assets/js/vendor/modernizr-custom.js : goo.gl/ 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/css/dist/akismet.php : md5_check.php 
/home/httpd/vhosts/csgotinky.ru/httpdocs/license.php : move_uploaded_file 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-admin/includes/file.php : move_uploaded_file 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/css/new_side.php : move_uploaded_file 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/js/codemirror/codemirror.min.js : move_uploaded_file 

Maybe evil code in firsts lines [8 seconds]:

/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/newsrsss.php : 64_decode |  
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/newsslide.php : 64_decode |  
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/wp-update.php : [@]set_time_limit[(]0[)]; |  
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-load.php : \$_COOKIE | error_reporting[(]0[)]; |  
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/plugins/wpgrabber/core/WPGTools.php : \$_POST |  
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/db.php : \$_POST | \$_FILES | error_reporting[(]0[)]; |  
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/sodium_compat/namespaced/Core/ChaCha20/content-post.php : \$_POST | error_reporting[(]0[)]; |  
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/sodium_compat/namespaced/Core/Curve25519/Ge/simpleside.php5 : \$_POST | error_reporting[(]0[)]; |  
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/jarida/custom-classes.php : error_reporting[(]0[)]; |  
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/js/tinymce/langs/wp-api.php : error_reporting[(]0[)]; |  
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/js/tinymce/langs/wp-points.php : error_reporting[(]0[)]; |  
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/wp-cd.php : error_reporting[(]0[)]; |  
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/pop-side.php : preg_replace |  
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/sodium_compat/namespaced/Core/Curve25519/wp-blogsnew.php : preg_replace |  
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/sodium_compat/namespaced/Core/Poly1305/confg.php : preg_replace |  
/home/httpd/vhosts/csgotinky.ru/httpdocs/bestside.php : preg_replace | 64_decode |  
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/bestside.php : preg_replace | 64_decode |  
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/plugins/wp-fastest-cache-premium/pro/templates/buy_credit.php : str_replace |  
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/Requests/Utility/single-side.php : str_replace |  
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/wp-data.php : str_replace | 64_decode | [@]set_time_limit[(]0[)]; | error_reporting[(]0[)]; |  


List big string in php file (file_name number_str length) [13 seconds]:
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/wp-data.php 1 6810 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/Requests/Transport/wp-side.php 1 27191 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/css/dist/components/wp-menus.php 1 25509 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/pop-side.php 3 21719 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/sodium_compat/namespaced/Core/Curve25519/wp-blogsnew.php 3 23547 
/home/httpd/vhosts/csgotinky.ru/httpdocs/bestside.php 4 22237 
/home/httpd/vhosts/csgotinky.ru/httpdocs/index.php 4 33910 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/bestside.php 4 22237 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/sodium_compat/namespaced/Core/Poly1305/confg.php 4 19649 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/plugins/cyr2lat/lib/polyfill-mbstring/Resources/unidata/titleCaseRegexp.php 5 6105 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/js/tinymce/langs/wp-api.php 5 31718 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/js/tinymce/langs/wp-points.php 5 30271 
/home/httpd/vhosts/csgotinky.ru/.cl.selector/ini_menu_getETCreateNewTicket.php 8 120004 
/home/httpd/vhosts/csgotinky.ru/.cl.selector/menu_getETCreateNewTicket.php 8 120004 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/plugins/adsplacer/settings_phpfunc.php 8 120004 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/jarida/panel/mod_x.php 8 116396 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/indx.php 8 120003 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/jarida/panel/shortcodes/ui.php 9 32007 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/plugins/recent-posts-widget-extended/includes/functions.php 19 1179 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/twentyfifteen/header.php 22 2363 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/plugins/cybersyn/fivefilters-full-text-rss/libraries/htmLawed/htmLawed.php 23 1369 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/plugins/wp-fastest-cache/templates/update_now.php 23 15701 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/plugins/wp-fastest-cache/templates/cdn/cloudflare.php 43 1115 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/css/dist/akismet.php 50 33327 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/plugins/wp-fastest-cache/templates/cdn/maxcdn.php 64 2356 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/plugins/wp-fastest-cache/templates/cdn/other.php 64 2139 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/plugins/wp-fastest-cache/templates/cdn/photon.php 70 2951 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/tbl_status.php 85 20815 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/uploader.php 91 15107 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-admin/includes/ajax-actions.php 187 1133 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/twentynineteen/classes/class-twentynineteen-svg-icons.php 243 2591 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/SimplePie/Misc.php 278 2936 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/plugins/cybersyn/fivefilters-full-text-rss/libraries/simplepie/library/SimplePie/Misc.php 294 2936 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/plugins/cybersyn/fivefilters-full-text-rss/index.php 346 2659 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/plugins/wpgrabber/tmpl/edit.php 422 1478 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/embed.php 458 1405 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/plugins/cybersyn/fivefilters-full-text-rss/libraries/simplepie/library/SimplePie/Parser.php 654 6613 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/includes/class-restarter-customizer.php 657 1969 
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-includes/formatting.php 5536 1871 

List old file [0 seconds]:
53743682    4 -rw-r--r--   1 a306934_6 psacln        743 Jan  1  1970 /home/httpd/vhosts/csgotinky.ru/httpdocs/license.php

List scripts perm 755 [0 seconds]:
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/searchform.php
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/sidebar.php
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/noitems_ajax.php
/home/httpd/vhosts/csgotinky.ru/httpdocs/wp-content/themes/restarter/single.php

Result scan antivirus [279 seconds]:
/home/httpd/vhosts/csgotinky.ru/.cagefs/tmp/phpd.local: Mchost.sigs-PHP.EXPLOIT.UNOFFICIAL FOUND