I've recently been hacked on my VPS(using Centos 7.6 and CWP up to date) and the following files/folders were created:
/tmp/.ICEd-unix
/var/tmp/.ICEd-unix
/tmp/kdevtmpfsi
/var/tmp/kinsing
The following processes were running and using 100% CPU and Memory: