modules too

Author: mattiasgeniar

found_on_drupal/found_due_to_cve_2018_7600/README.md

@@ -7,6 +7,6 @@ They are the direct result of [CVE-2018-7600](https://www.drupal.org/sa-core-201
 The pattern:
 
 - search.php, dump.php & wp-post.php: same filename everywhere. Always in the root of the Drupal installation.
-- favicon_0ac3c0.ico: the `0ac3c0` part is a variable hash every time. The file gets dumped somewhere in the `/themes/` directory.
+- favicon_0ac3c0.ico: the `0ac3c0` part is a variable hash every time. The file gets dumped somewhere in the `/themes/` or `/modules/` directory.
 
 These can easily be found & detected through a combination of [Maldet](https://www.rfxn.com/projects/linux-malware-detect/) and regex-searches on functions like `eval`, `gzinflate`, etc.