_EVENT_FILTER_HEADER

Metadatacopy
struct _EVENT_FILTER_HEADER {
    unsigned short Id;/* 0x0  2 */
    unsigned char Version;/* 0x2  1 */
    unsigned char Reserved[5];/* 0x3  5 */
    unsigned __int64 InstanceId;/* 0x8  8 */
    unsigned long Size;/* 0x10  4 */
    unsigned long NextOffset;/* 0x14  4 */
};