Port 22

IcedID malware, in the hijacked email thread, with the insecure Exchange servers