You can use WinpkFilter built-in filters to intercept only packets destined to port 80. For the intercepted packet you can get a pointer to packet data and search for the “explorer” string. If you modify the packet you have to recalculate packets TCP and IP checksums. Also, if you modify packet length you also have to affect TCP header.
