struct _EVENT_FILTER_HEADER// Size=0x18
{
    unsigned short Id;// Offset=0x0 Size=0x2
    unsigned char Version;// Offset=0x2 Size=0x1
    unsigned char Reserved[5];// Offset=0x3 Size=0x5
    unsigned long long InstanceId;// Offset=0x8 Size=0x8
    unsigned long Size;// Offset=0x10 Size=0x4
    unsigned long NextOffset;// Offset=0x14 Size=0x4
};