Identification of (malicious) modifications in memory-mapped image files