This is something you dont want to see in wordpress files, because it looks like your site got hacked.
But this is way out of the scope of hestia, we can’t help you out to debug your code or replace any sysadmin knowledge. I strongly suggest to suspend that user, get professional help and/or switch over to a managed webhosting.
Just that I wrote it again: Hestia isnt a replacement for any sysadmin skills or/and knowledge, it should be an enhancement. That’s why this is here: Please read this, before you start! and aswell @falzo made a proper writeup Ioncube step by step - #3 by falzo