# Machine-readable malware/planted paths (docroot-relative) excluded from the baseline.
# Consumed by build-baseline.sh step 6. Rationale + IOC detail in malware-iocs.md.
# NOTE: the 3 injected core files (auth/joomla.php, session/storage.php, event/event.php)
# are NOT listed here — they are RESTORED to clean vanilla by the official core package.
wp-stomp.php
hyjhxp.php
libraries/joomla/session/cache.php
administrator/components/com_joomlaupdate/never.php
modules/mod_seolite
modules/mod_articles_single
modules/mod_al_upload/b8.php
modules/mod_course_list/a1.php
templates/trada/html/mod_articles_category/meant.php
templates/category/tiny.php
templates/system/links.db
components/com_extplorer
administrator/components/com_extplorer
components/com_joml_incf
administrator/components/com_joml_incf
components/com_sys_rom
administrator/components/com_sys_rom