wpwebsi2@wpwebsitehosting.com [~/public_html/runlandpainting/wp-admin/includes]# stat network.php
  File: `network.php'
  Size: 39815     	Blocks: 80         IO Block: 4096   regular file
Device: 841h/2113d	Inode: 93328926    Links: 1
Access: (0644/-rw-r--r--)  Uid: (  602/wpwebsi2)   Gid: (  603/wpwebsi2)
Access: 2018-09-10 00:28:59.000000000 -0600
Modify: 2018-09-10 00:28:59.000000000 -0600
Change: 2019-06-05 01:11:03.986426686 -0600
wpwebsi2@wpwebsitehosting.com [~/public_html/runlandpainting/wp-admin/includes]# date
Wed Jun  5 12:00:29 MDT 2019
wpwebsi2@wpwebsitehosting.com [~/public_html/runlandpainting/wp-admin/includes]#


The file was changed on server time

> Change: 2019-06-05 01:11:03.986426686 -0600

Current sevrer time

> Wed Jun  5 12:00:29 MDT 2019

So hack was done like 4 hrs ago.