Automatic extraction bug?

[ursol]

Hi,

I am facing the next problem. When having the next _raw:

process="\"C:\\Windows\\regedit.exe\" /s \"C:\\Program Files (x86)\\SAP\\RPW.reg\""

The value of the process field that I expect is:

"C:\Windows\regedit.exe" /s "C:\Program Files (x86)\etc\etc.etc"

But what the automatic extraction gets is the same but without the initial and ending quotation marks:

C:\Windows\regedit.exe" /s "C:\Program Files (x86)\etc\etc.etc

Any ideas of how to get the expected value? It seems it doesn't respect the escaped characters.

[johnhuang]

Could you post an example of _raw and also the regex that is used to extract this field?