Port 5985: WinRM HTTP
Port 5985 is Windows Remote Management over HTTP, used for PowerShell remoting.
What runs on port 5985
WinRM listens on TCP 5985 (HTTP) and 5986 (HTTPS) and lets administrators run PowerShell commands on remote Windows machines. It is enabled by default on Windows Server and off on client Windows.
On a home network
Home PCs do not normally listen on 5985 unless someone ran Enable-PSRemoting. Small offices with a Windows server will have it on that server.
If port 5985 is reachable from the internet
WinRM on the internet invites password guessing that, if it succeeds, gives an attacker a full remote shell. It is a favourite tool for attackers moving between machines inside networks. Keep it internal.
How to check whether it is open on your network
Check port forwarding rules for 5985 and 5986. On Windows, running winrm enumerate winrm/config/listener in an administrator prompt shows whether it is listening.
To find out whether port 5985 is open on something in your home, and whether the internet can reach it, the app scans your Wi-Fi from your phone and checks your public address from the outside. It says what it checked and what it could not. Get RECON for iPhone — one-time purchase, no account, nothing leaves the device.