hModule [in] Handle to the module whose file name is being requested. If this parameter is NULL, GetModuleFileName returns the path for the file containing the current process. lpFilename [out] ...

[*] Relaying context: \PC-01$ [*] Rewriting function table [*] Rewriting PEB [*] GetModuleFileName: System [*] Init com server [*] GetModuleFileName: C:\Users\test1 ...