Port sometimes used as default/consecutive port when configuring programs/malware/botnets, because it follows a very common default high port "5 6 7 8 9". As such, programs/malware that need multiple open ports often use sequential ports 56790, 56791, etc.