ar-win-2.attackrange.local AR-WIN-2$ C:\Windows\System32\svchost.exe TiWorker.exe C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.14393.6250_none_7f16785821e211b6\TiWorker.exe -Embedding