An analyst detonates a suspicious executable in an automated sandbox. The report shows the sample writes a randomly named DLL to %AppData%, creates a registry Run key, then contacts three different domains that each resolve to the same IP block and use identical TLS certificate serial numbers. The analyst wants to produce a durable, high-fidelity detection artifact that will still match future variants of this malware family even if the file hash changes. Which action produces the most effective complex indicator?