How does the `.NET_oneliner` payload load assemblies from memory in Pupy?

The `.NET_oneliner` payload generates a PowerShell command that uses `[Reflection.Assembly]::Load()` to download and execute a .NET assembly directly from memory. For example: `powershell -w hidden -enc "xxxxxxxxxxxxxx"`. This approach avoids writing the assembly to disk and leverages PowerShell's ability to load .NET objects. The underlying technique is further analyzed in the article [Analysis of Exploiting .NET Assembly Loading from Memory (Assembly.Load)](/news/pupy-exploitation-analysis-features-on-windows-platform) — note that the provided content references a previous article on this topic, but you can also refer to the main Pupy feature article for context.