An analyst has a PCAP of an HTTP session where a host downloaded a suspicious executable. Using Wireshark, the analyst needs to reconstruct and save the exact binary that was transferred so it can be submitted to a malware sandbox. Which Wireshark action correctly extracts the transferred file from the TCP stream?