heimdall.php

That file is associated to ransomware software (more info here >> https://www.bleepingcomputer.com/news/security/heimdall-open-source-php-ransomware-targets-web-servers/), so you if that file was on your server, it does point to a server compromise that you need to deal with.

You should take steps to remove the file, and check your server for a likely breach…
https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/
https://www.wordfence.com/learn/how-to-secure-your-wordpress-working-environment/

Note – I’m simply a long-time WF user, and not part of WF support.