The second part of API hooking hooks on “GetExtendedTcpTable. GetExtendedTcpTable” is used for retrieving a table that contains a list of TCP endpoints available to the application, and it is frequently used in some network-related commands, such as netstat. The purpose of the hook is to remove TCP endpoint records of certain PIDs. The second function, “GetRTTAndHopCount,” acts as the place to put the injected hooking code