Internet-Security.com TCP port 49155 details

TCP 49155 is commonly used on Microsoft Windows as part of the default dynamic RPC port range (49152–65535).
Windows RPC-based services can bind to it at runtime, including WMI/DCOM, Active Directory RPC interfaces on domain controllers (e.g., LSARPC/SAMR/Netlogon), and various MMC/administrative components.
Microsoft SQL Server named instances, when configured for dynamic ports, often listen on a randomly assigned port in this range; 49155 is frequently observed in real deployments.
Backup/management tools that rely on Windows RPC—such as Veeam Backup & Replication and Microsoft System Center Configuration Manager (client push, remote admin)—will use whichever dynamic RPC port is allocated, which can be 49155.
Older or non-hardened Microsoft Exchange deployments have components that use dynamic RPC ports unless configured to a static value, so 49155 may appear there as well.
Because it falls in the Windows RPC dynamic range, this port is often seen during intrusion lateral movement that abuses MSRPC/DCOM/WMI, though the port itself isn’t uniquely malicious.

TCP 49155