[Size] 64-bit timestamp [Description] The date and time the event was initiated. You can use the FileTimeToSystemTime Win32 function to retrieve the date and time information from this field. The time is precise to approximately 10 milliseconds. [Element name] 
TIME
S T R U C T U R E _ I D
S I Z E
T I M E
C O N N E C T I O N _ I D
S T A T E
C H E C K S U M