Just by looking at your posted output, I can see a cryptocurrency miner xmrig running. If you did not intend to launch that process, someone with sufficient access was able to.
You posted two processes, each of them look very suspicious:
30741 www-data 20 0 89556 10264 4 S 213.6 0.1 26636:45 /tmp/sshm -c /tmp/.u
This is a process owned by www-data running an executable, /tmp/sshm, with the argument /tmp/.u. You should be able to inspect those two files to determine if they are malicious or not.
18575 www-data 20 0 725948 10244 56 S 212.3 0.1 6608:57 /tmp/.FILE/stak/ld-linux-x86-64.so.2 --library-path /tmp/.FILE/stak /tmp/.FILE/stak/xmrig -o 195.22.126.117:443 -u 45ENzNUptUrV8nLM2Cwwwb1r98M7ZPocmdsmg1SKWAL6b8DJQcU3+
This is another process owned by www-data, and this is the cryptocurrency miner. It has installed itself into /tmp/.FILE. If you did not install and run this, then you are most certainly exploited somewhere.
If those processes are malicious, you want to kill them so they stop running. You would then want to look for the entry point of these malicious files. Since they are owned by www-data, you most likely have a legitimate process on this server running as that user, possibly a web server or application, that is allowing the creation and execution of these files.
You need to find that entry point as soon as you can and fix it, or the malicious files will probably just come back again. Looking at your log files should help. Make sure to check anything that the www-data user is able to do. Double check your web server and/or web applications to make sure they are not allowing the installing and execution of these files.
One server hardening step I have seen to mitigate these kind of issues is to not allow exec from /tmp at all: mount -o noexec,remount /tmp.
www-data(httpd) from/tmp, then your server is quite possibly hacked.