Data Exfiltration via HTTPS Upload

In an authorized exercise, create a password-protected ZIP from already identified files and upload it over HTTPS to an explicitly approved receiver distinct from the active command-and-control channel. The receiver must accept a multipart form field named `file` at the specified upload path. This is an HTTPS transfer to a configured receiver, not an upload to an existing public web service.