well in my case it's tls, don't know if it is well papered trick tho.

anyway there's nice plug on reversing.be NtGlobalFlag by stingduk/jm, that can help you catch it.

read what junemouse has to say:
http://www.exetools.com/forum/showthread.php?t=7363