explain locations

Author: mattiasgeniar

found_on_drupal/found_due_to_cve_2018_7600/README.md

@@ -6,7 +6,7 @@ They are the direct result of [CVE-2018-7600](https://www.drupal.org/sa-core-201
 
 The pattern:
 
-- search.php, dump.php & wp-post.php: same filename everywhere
-- favicon_0ac3c0.ico: the `0ac3c0` part is a variable hash every time
+- search.php, dump.php & wp-post.php: same filename everywhere. Always in the root of the Drupal installation.
+- favicon_0ac3c0.ico: the `0ac3c0` part is a variable hash every time. The file gets dumped somewhere in the `/themes/` directory.
 
 These can easily be found & detected through a combination of [Maldet](https://www.rfxn.com/projects/linux-malware-detect/) and regex-searches on functions like `eval`, `gzinflate`, etc.