A process name matches a common administration tool. Which evidence best helps determine whether its execution is suspicious?

1. Parent process, command line, signer, account, timing, and surrounding activity
2. The number of desktop shortcuts
3. Whether the device has enough free disk space
4. The executable name alone