Struct DeletedExeFinding 

pub struct DeletedExeFinding {
    pub pid: u32,
    pub comm: String,
    pub exe_path: String,
    pub original_path: String,
}

A lightweight finding produced by the pure-logic deleted-exe classifier, suitable for use without a full memory-image reader.

Fields

pid: u32

Process ID.

comm: String

Process name (task_struct.comm, max 16 chars).

exe_path: String

Full exe path as seen in memory — includes the (deleted) suffix.

original_path: String

Exe path with the (deleted) suffix and trailing whitespace stripped.

Trait Implementations

impl Clone for DeletedExeFinding

fn clone(&self) -> DeletedExeFinding

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DeletedExeFinding

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for DeletedExeFinding

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for DeletedExeFinding

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.