WinRM was possibly detected running on tcp port 5985.
Check _manual_commands.txt for manual commands you can run against this service.