So this method uses psexec itself to copy the payload over the network, overwrite earlier versions (if found), and run it without waiting for any response. They use batch files that leverage psexec , again, to push PowerShell loader scripts out to machines the network scanner finds on the internal network.