What are the two methods for actually deleting the log record once the handle and parameters are obtained?
The first method parses the EVTX binary format manually, locates the record with the specified `EventRecordID`, and overwrites it in memory before flushing to disk. The second method uses the Windows API `EvtExportLog` to export the log file while excluding the target record, then replaces the original file with the filtered result. Both methods are implemented in the injected DLL and the loader, as shown in the Windows XML Event Log (EVTX) Single Log Entry Deletion (Part 5) – Deleting a Single Log Entry from the Current System by Obtaining Log File Handle via DuplicateHandle.
EVTX binary parsingEvtExportLoglog record deletionfile mappingmemory modification