#ifndef _NTRTL_H

// private
/**
 * The RTL_UNLOAD_EVENT_TRACE structure contains information about modules unloaded by the current process.
 *
 * \sa https://learn.microsoft.com/en-us/windows/win32/devnotes/rtlgetunloadeventtrace
 */
typedef struct _RTL_UNLOAD_EVENT_TRACE
{
    PVOID BaseAddress;   // Base address of dll
    SIZE_T SizeOfImage;  // Size of image
    ULONG Sequence;      // Sequence number for this event
    ULONG TimeDateStamp; // Time and date of image
    ULONG CheckSum;      // Image checksum
    WCHAR ImageName[32]; // Image name
    ULONG Version[2];
} RTL_UNLOAD_EVENT_TRACE, *PRTL_UNLOAD_EVENT_TRACE;

#endif
View code on GitHub