struct _EVENT_HEADER// Size=0x50
{
    unsigned short Size;// Offset=0x0 Size=0x2
    unsigned short HeaderType;// Offset=0x2 Size=0x2
    unsigned short Flags;// Offset=0x4 Size=0x2
    unsigned short EventProperty;// Offset=0x6 Size=0x2
    unsigned long ThreadId;// Offset=0x8 Size=0x4
    unsigned long ProcessId;// Offset=0xc Size=0x4
    union _LARGE_INTEGER TimeStamp;// Offset=0x10 Size=0x8
    struct _GUID ProviderId;// Offset=0x18 Size=0x10
    struct _EVENT_DESCRIPTOR EventDescriptor;// Offset=0x28 Size=0x10
    unsigned long KernelTime;// Offset=0x38 Size=0x4
    unsigned long UserTime;// Offset=0x3c Size=0x4
    unsigned long long ProcessorTime;// Offset=0x38 Size=0x8
    struct _GUID ActivityId;// Offset=0x40 Size=0x10
};