CRPx0 Pre-Encryption Chunked Exfil via relay.php ~512KB POSTs
Detects anomalous, repeated 512KB multipart POST requests sent to a 'relay.php' endpoint, indicative of bulk data exfiltration performed by the CRPx0 ransomware prior to file encryption.
YARA-L
