[pratham]

use netstat command in cmd when the RAT user is online and check ur ip status.. Ur ip is connecting to which ip.. U can find the ip of that person.. And most of the time rat virus is installed in windows dir in c:\ otherwise in documents app\local