Site Hacked - Help needed to remove

I've found the same thing on my site.
In my case the reason was in the "Core Services" plugin. After I've switched it off all adds has gone.
Does anybody know, what this plugin for?

Hi brzhezinskiy,
That's interesting.
We don't have that add-on running or installed on our site, but there may be one that has the hacked code inside it. I will switch off each of the add-ons and see if it's the culprit.
Thanks!

There is no such "Core Services" plugin. That was installed by a hacker that used one of the login vulnerabilities to get Manager access. See https://forums.modx.com/thread/89564/warning-hacking-attack-on-revo-2-2-4-using-core-services-plugin