04 PE in memory of powershell