Stacks view

The stacks view displays the stacks that were collected during the action performed between two process nodes in the Investigation View when an edge is selected. The stack entries include the executables and DLLs involved in the process stack. The stack entries due to which the event was triggered are highlighted with a red background. The main stack entry, which means the first one, is marked with a separator.

For each executable, you can see the following information:

• Executable File Name: Specifies the filename of the executable.
• Signature: Specifies whether or not the file was signed. Possible values: Signed, Unsigned, Self-signed, Invalid timestamp, Signed (no timestamp).
• Size: Specifies the size of the file.
• Base Address of this entry in memory.
• End Address of this entry in memory.
• Hash: Specifies the file hash. No hash is available for memory items.
• Owner: Specifies the owner of the file.
• Writable memory is indicated by the icon at the front of the stack.

You can also expand a stack to view more details, such as the last modified time (not available for writable memory entries), whether or not the stack entry is of OS executable or console application for executables and DLLs.

You can perform the following actions in the stacks view table:

• Remediate a file or retrieve memory using the Remediate or Retrieve buttons () at the top-left of the table.

• Customize the columns to display in the table using the Customize button ().

• Search for a specific stack entry using the search bar on the top right corner ().