Inside the "ghostroot" folder. There was a slew of dangerous looking shit in there.