I am analyzing a mem and trying to recover a file that an attacker used to exploit drupalgeddon2 vulnerability. I discover that the process with pid 11046 executes the request with the file h38x.php (the one the attacker submitted). I need to somehow extract the file or the hash. Is there any way to do that with volatility?

I am analyzing a mem and trying to recover a file that an attacker used to exploit drupalgeddon2 vulnerability. I discover that the process with pid 11046 executes the request with the file h38x.php (the one the attacker submitted). 

I need to somehow extract the file or its hash. Is there any way to do that with volatility?

I am analyzing a mem and trying to recover a file that an attacker used to explote drupalgeddon2 vulnerability. I discover that the process with pid 11046 execute the request with the file h38x.php (the one the attacket submmit). I need to extract somehow the file or the hash. Is there any way to do that with volatility?

I am analyzing a mem and trying to recover a file that an attacker used to exploit drupalgeddon2 vulnerability. I discover that the process with pid 11046 executes the request with the file h38x.php (the one the attacker submitted). I need to somehow extract the file or the hash. Is there any way to do that with volatility?