A suspicious process beaconed every five minutes for three days. Which data source most directly helps establish the remote destination and connection timing across that period?

1. Historical network flow or proxy records
2. Only the keyboard layout setting
3. Only the current process list
4. Only the account's password age