# archlinexp.eu — malware/planted paths (docroot-relative), excluded from the baseline. # Generated from the live-vs-vanilla-3.9.2 diff (2026-07-17). Content-based .json # droppers under templates/ are additionally caught by build-baseline.sh step 6/(a). .htaccess.json 1337.php.json 1337p.php.json 4faas4yn3dn0.phar.json 4faas4yn3dn0.php.json 4faas4yn3dn0.php5.json 4faas4yn3dn0.php7.json 4faas4yn3dn0.phtml.json 70pv0kju.php.json 70pv0kju.php5.json 70pv0kju.phtml.json 7days.json 8060lgz1cqeu.gif.json 8060lgz1cqeu.gif.php.json 8060lgz1cqeu.jpeg.json 8060lgz1cqeu.jpeg.php.json 8060lgz1cqeu.jpg.json 8060lgz1cqeu.jpg.php.json 8060lgz1cqeu.phar.json 8060lgz1cqeu.php.json 8060lgz1cqeu.php5.json 8060lgz1cqeu.phtml.json 8060lgz1cqeu.png.json 8060lgz1cqeu.png.php.json 8j7txp50.php%00.jpg.json 8j7txp50.php%00.txt.json 8j7txp50.php.bak.json 8j7txp50.php.jpg.json 8j7txp50.php.json 8j7txp50.php.txt.json 8j7txp50.php4.json 8j7txp50.php5.json 8j7txp50.phtml.json _h3x_0tc4t3dy.php.json _h3x_19b8fmhn.php.json.json _h3x_2xbk7ug3.php.json _h3x_672ba9cf.php.json _h3x_6h0804r6.php.json _h3x_8nom65ew.php.json _h3x_ajhdpqok.php.json _h3x_fiqbuwjw.php.json.json _h3x_kgetu0xr.php.json _h3x_kgqxc7tj.php.json _h3x_knton7qj.php.json _h3x_m28547fv.php.json _h3x_qdjyeroc.php.json _h3x_r02w559c.php.json _h3x_v6hzbjh8.php.json _h3x_vimcjrhc.php.json.json _h3x_vunx1gid.php.json _h3x_y6oge9dr.php.json administrator/4faas4yn3dn0.php.json administrator/8060lgz1cqeu.php.json administrator/8j7txp50.php.json administrator/cache/c_03e0fd55.php.json administrator/cache/c_7f0b46f9.php.json administrator/cache/f46vc3nzn1qw.php.json administrator/components/f46vc3nzn1qw.php.json administrator/f46vc3nzn1qw.php.json administrator/index.php.json administrator/ko6h7s5e9kak.php.json administrator/language/f46vc3nzn1qw.php.json administrator/ntxvq7b4jper.php.json administrator/templates/hathor/index.php.json administrator/templates/isis/index.php.json administrator/yhajxaav.php.json bdkr28.json bexkn.php.json blackleets.json boss.json c_03e0fd55.php.json c_7f0b46f9.php.json cache/8j7txp50.php.json cache/_h3x_9zbnowsb.php.json.json cache/_h3x_e4pk161f.php.json.json cache/_h3x_r16oprou.php.json.json cache/c_03e0fd55.php.json cache/c_7f0b46f9.php.json cache/d6g30n.php.json cache/f46vc3nzn1qw.php.json cache/info.php.json cache/p8xu5l.php.json cache/shell.php.json cache/yhajxaav.php.json captain.json cbdjs.json cernunnos.json components/com_content/f46vc3nzn1qw.php.json components/com_joomgallery/views/image/view.jpg.php components/f46vc3nzn1qw.php.json configuration.php cox.json cyberdjs.json d6g30n.php.json es6jo0xq.php.json es6jo0xq.php5.json es6jo0xq.phtml.json f46vc3nzn1qw.php.json f46vc3nzn1qw.php5.json f46vc3nzn1qw.php7.json f46vc3nzn1qw.phtml.json files/_h3x_2hjfdfr5.php.json.json files/_h3x_aqjg408i.php.json.json files/_h3x_vp8mjkv7.php.json.json flamy.json flamy.php.json friska.php.json ghosthaxor.json h0rn3t.json h3x_49822__php.json hwlyroez.json hwlyroez.php.json hwlyroez.phtml.json images/4faas4yn3dn0.php.json images/4faas4yn3dn0.phtml.json images/6iyo68ipsz.php.json images/8060lgz1cqeu.phar.json images/8060lgz1cqeu.php.json images/8060lgz1cqeu.phtml.json images/8j7txp50.php.json images/_h3x_6h0804r6.php.json images/_h3x_6h0804r6.php5.json images/_h3x_6h0804r6.phtml.json images/_h3x_ajhdpqok.php.json images/_h3x_ajhdpqok.php5.json images/_h3x_ajhdpqok.phtml.json images/_h3x_hzba1jvm.php.json.json images/_h3x_je0zgowm.php.json.json images/_h3x_kgqxc7tj.php.json images/_h3x_kgqxc7tj.php5.json images/_h3x_kgqxc7tj.phtml.json images/_h3x_ott0201u.php.json.json images/_h3x_qdjyeroc.php.json images/_h3x_qdjyeroc.php5.json images/_h3x_qdjyeroc.phtml.json images/_h3x_v6hzbjh8.php.json images/_h3x_v6hzbjh8.php5.json images/_h3x_v6hzbjh8.phtml.json images/_php_baeda0.php.json images/backup.f46vc3nzn1qw.php.json images/c_03e0fd55.php.json images/c_7f0b46f9.php.json images/d6g30n.php.json images/d_96ac.php.json images/f46vc3nzn1qw.php.json images/h3x_2i8n13gl.php.json images/h3x_33dbxlod.phtml.json images/h3x_9997u119.php.json images/h3x_e88bc62u.phtml.json images/h3x_g3rhd4hx.php.json images/h3x_gp0vatrc.php.json images/h3x_irj8ng6m.php.json images/h3x_jaynjuu6.phtml.json images/h3x_jhd6r2bk.php.json images/h3x_lk6pzgbt.phtml.json images/h3x_p29ivhj8.php.json images/h3x_r1mc7roy.php.json images/h3x_rbaryhg8.php.json images/h3x_rgzfvyoc.phtml.json images/h3x_s23jezbz.php.json images/h3x_v82n3yod.phtml.json images/h3x_vvpvaj6o.php.json images/h3x_xzw4q6cs.php.json images/ko6h7s5e9kak.php.json images/ko6h7s5e9kak.phtml.json images/ntxvq7b4jper.php.json images/ntxvq7b4jper.phtml.json images/p8xu5l.php.json images/shell.php.json images/temp.f46vc3nzn1qw.php.json images/uo89i5.php.json images/yhajxaav.php.json info.php.json joth73.json ko6h7s5e9kak.phar.json ko6h7s5e9kak.php.json ko6h7s5e9kak.php5.json ko6h7s5e9kak.php7.json ko6h7s5e9kak.phtml.json kvjrvsep.json language/f46vc3nzn1qw.php.json logs/8j7txp50.php.json logs/_h3x_hzuz4jb8.php.json.json logs/_h3x_nbmlj4wd.php.json.json logs/_h3x_nyg1j0r2.php.json.json logs/f46vc3nzn1qw.php.json logs/yhajxaav.php.json loopenx.json lumup.php.json lx.html.json maintht.json media/4faas4yn3dn0.phtml.json media/8060lgz1cqeu.phtml.json media/8j7txp50.php.json media/_h3x_hn5jabjv.php.json.json media/_h3x_qkrfp39e.php.json.json media/_h3x_sp89teja.php.json.json media/c_03e0fd55.php.json media/c_7f0b46f9.php.json media/d6g30n.php.json media/f46vc3nzn1qw.php.json media/ko6h7s5e9kak.phtml.json media/ntxvq7b4jper.php.json media/p8xu5l.php.json media/shell.php.json media/yhajxaav.php.json modules/f46vc3nzn1qw.php.json modules/mod_custom/f46vc3nzn1qw.php.json night.html.json ntxvq7b4jper.php.json ntxvq7b4jper.phtml.json nxproof.php.json p8xu5l.php.json phpinfo.php.json shadow.php.json shell.json smok.json smok3r.json stfu.json templates/.htaccess.json templates/_h3x_672ba9cf.json templates/_h3x_672ba9cf.php.json templates/beez3/f46vc3nzn1qw.php.json templates/beez3/index.php.json templates/cox.json templates/d6g30n.php.json templates/f46vc3nzn1qw.php.json templates/index.php.json templates/lx.html.json templates/night.html.json templates/ntxvq7b4jper.php.json templates/nxproof.php.json templates/p8xu5l.php.json templates/protostar/f46vc3nzn1qw.php.json templates/protostar/index.php.json templates/shaper_helix3/layout/default.json templates/shaper_helix3/layout/uploader_8kykulyz.php.json.json templates/shaper_helix3/layout/uploader_g1jujsa9.php.json.json templates/shaper_helix3/layout/uploader_q1z4oez8.php.json.json templates/shaper_helix3/layout/uploader_uwqytc5i.php.json.json templates/shaper_helixultimate/.htaccess.json templates/shaper_helixultimate/_h3x_672ba9cf.json templates/shaper_helixultimate/_h3x_672ba9cf.phar.json templates/shaper_helixultimate/_h3x_672ba9cf.php.json templates/shaper_helixultimate/_h3x_672ba9cf.php5.json templates/shaper_helixultimate/_h3x_672ba9cf.phtml.json templates/shaper_helixultimate/_hxte7rcz9e.php.json templates/shaper_helixultimate/_hxter275wt.php.json templates/shaper_helixultimate/_hxtes04s5q.php.json templates/shaper_helixultimate/_hxtes3fimi.php.json templates/shaper_helixultimate/cox.json templates/shaper_helixultimate/lx.html.json templates/shaper_helixultimate/night.html.json templates/shaper_helixultimate/nxproof.php.json templates/shaper_helixultimate/options.json templates/shaper_helixultimate/up.php.json templates/up.php.json tmp/8j7txp50.php.json tmp/_h3x_axg1w8kw.php.json.json tmp/_h3x_ipxvztce.php.json.json tmp/_h3x_ul3ooiwi.php.json.json tmp/c_03e0fd55.php.json tmp/c_7f0b46f9.php.json tmp/f46vc3nzn1qw.php.json tmp/shell.php.json tmp/wirrd.php.json tmp/yhajxaav.php.json up.php.json uploaded.json.php.json uploader.json vile.json vile.json.json vile.php.json vile.php.json.json wp-blog.php.json wp-blog.php.json.json x9.json x9txt.json yetixx.json yhajxaav.php%00.jpg.json yhajxaav.php%00.txt.json yhajxaav.php.bak.json yhajxaav.php.jpg.json yhajxaav.php.json yhajxaav.php.txt.json yhajxaav.php4.json yhajxaav.php5.json yhajxaav.phtml.json zyfnar.php.json # --- Strukturális szűrés (2026-07-17): extra fájl CORE-komponens útvonalán, # ami nem template-override. A tartalmi YARA egyiket sem fogta. components/com_mailto/mail.php administrator/components/com_joomlaupdate/restoration.php