diff --git a/EtwRegisteredProvidersForProcess b/EtwRegisteredProvidersForProcess
new file mode 100644
index 0000000..0d0cf68
--- /dev/null
+++ b/EtwRegisteredProvidersForProcess
@@ -0,0 +1,2 @@
+dx @$pid = 0xABCD
+dx @$cursession.Processes[@$pid].Io.Handles.Where(h => h.Type == "EtwRegistration").Select(h => ((nt!_ETW_REG_ENTRY*)(&h.Object.Body))->GuidEntry->Guid)