Windows Sysinternals tool for remote command execution. NotPetya included a lightweight PsExec implementation that created remote services. - **WMI (Windows Management Instrumentation)** — Used to execute the payload on remote systems without creating new services, leaving fewer artifacts.