What port number would malware connect to that used the domain name mircosoft-update.serveuser.com?

DynCalc
Malicious software used by the DYNCALC group often used an algorithm to determine which port number to connect to on the command and control server. If the algorithm they used was:

(1st octet * 2nd octet) + 3rd octet

What port number would malware connect to that used the domain name mircosoft-update.serveuser.com?

You should try to work out the codes by yourself. If you're not sure ask another team mate because if this gets exposed to the ncsc, you will probably be disqualified.

Asking people on the internet is probably considered cheating. People are working hard to do this, please don't cheat. It won't help you if you get into the finals.