Internet-Security.com TCP port 49158 details

Windows (Vista/Server 2008 and later) uses TCP 49158 within its dynamic RPC range (49152–65535) for Microsoft RPC/DCOM and WMI; services like Remote Registry or Event Log may listen on this negotiated port after the RPC Endpoint Mapper on 135 directs clients.
Microsoft Lync/Skype for Business (and legacy Skype) use dynamic high ports 49152–65535 for media and file transfer, so TCP 49158 is often observed during active sessions.
UPnP IGD implementations on many consumer routers/CPE expose their HTTP control interface on high 4915x ports; it’s common to find the UPnP device description served on http://device:49158/ on units using libupnp/miniigd.
Exposed UPnP services on these ports (including 49158) have been abused in the past due to UPnP stack flaws, enabling information leakage, DDoS amplification, or in some cases remote code execution.

TCP 49158