Monitoring registry accesses with Regmon