dx @$pid = 0xABCD
dx @$cursession.Processes[@$pid].Io.Handles.Where(h => h.Type == "EtwRegistration").Select(h => ((nt!_ETW_REG_ENTRY*)(&h.Object.Body))->GuidEntry->Guid)
