This week I talk about examining Conhost data for evidence of execution.