I traced back the server that it was communicating with, found the owner through a friend in the company it was registered through. Emailed him at his technical contact email with a list of what was going to happen if he didn’t send me the protocol to remove his crap from my friends system. This started with every domain he owns disappearing from his name in 12 hours. To fast to transfer it. I got a very long detailed procedure, deleting odd files, searching nameless files, rebooting, deleting new odd files, rebooting…. Etc. Good times.