Hi,
I am facing the next problem. When having the next _raw:
process="\"C:\\Windows\\regedit.exe\" /s \"C:\\Program Files (x86)\\SAP\\RPW.reg\""
The value of the process field that I expect is:
"C:\Windows\regedit.exe" /s "C:\Program Files (x86)\etc\etc.etc"
But what the automatic extraction gets is the same but without the initial and ending quotation marks:
C:\Windows\regedit.exe" /s "C:\Program Files (x86)\etc\etc.etc
Any ideas of how to get the expected value? It seems it doesn't respect the escaped characters.
Could you post an example of _raw and also the regex that is used to extract this field?