drop file system + memory · detect herpaderped binaries · runs locally
disk vs memory hash mismatch · file modified after section map · herpaderping json exports
heuristic screener · parses artifacts locally · not definitive proof of herpaderping