During dynamic analysis of a suspicious executable in an isolated sandbox, an analyst observes the following behavior: the sample writes a copy of itself to %APPDATA%\svchost.exe, creates a value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to that file, and then beacons to an external IP every 60 seconds. The analyst must document a durable Indicator of Compromise (IOC) that other endpoints can be scanned for to detect the same infection even after the malware's C2 IP changes. Which observed artifact is the MOST reliable IOC to distribute for host-based detection?