ETW_HEAP_EVENT_RUNDOWN - NtDoc

#ifndef _NTWMI_H
#include <pshpack1.h>

typedef struct _ETW_HEAP_EVENT_RUNDOWN
{
    SYSTEM_TRACE_HEADER Header;     // Header
    PVOID HeapHandle;
    ULONG Flags;
    ULONG ProcessId;
    ULONG RangeCount;
    ULONG Reserved;   // for padding
    ETW_HEAP_EVENT_RUNDOWN_RANGE Ranges[1];
} ETW_HEAP_EVENT_RUNDOWN, *PETW_HEAP_EVENT_RUNDOWN;

#include <poppack.h>
#endif
View code on GitHub