FTP traffic by PDC

I notice on average 1mb an hour is being sent out by our PDC of FTP traffic. I’m not sure where it is going. I’m wondering if it is SAM replication traffic. Does the same replicate using FTP? Or is this something else? I believe we were hacked some months ago and I am trying to narrow down what purpose this traffic could have. Any ideas would be great. Thanks.