I am analyzing a mem and trying to recover a file that an attacker used to exploit drupalgeddon2 vulnerability. I discover that the process with pid 11046 executes the request with the file h38x.php (the one the attacker submitted).
I need to somehow extract the file or its hash. Is there any way to do that with volatility?
