typedef struct _EVENT_FILTER_HEADER
{
    unsigned short Id;
    unsigned char Version;
    unsigned char Reserved[5];
    unsigned __int64 InstanceId;
    unsigned long Size;
    unsigned long NextOffset;
} EVENT_FILTER_HEADER, *PEVENT_FILTER_HEADER;