NJRAT
Named by 3 kept items in this workspace.
Search every workspace for NJRAT. It matches the name as written, so it can find other things that share it.
The items that name it 3
foundation for KGB RAT
Malware/stealer family referenced as a prior user of the same Ngrok C2 IP infrastructure identified in this campaign.
All threat actors in this workspace.