Honestly We need your help to get around something, we saw some suspicious activity in our network, we investigated and noticed that someone is sniffing our network.
After that he proved that by threating us. Based on our analysis, behavior of the program he is using is exactly similar to this one.
Please try to get access to his computer so we can avoid any further damages.
It seems connecting to 18.104.22.168:2222 starts the session, this is one of our servers.