Please carry on as follows:
- Temporarily disable protected service in the HIPS setup and reboot the machine
- Start logging with Procmon
- Reproduce the issue
- After a while, stop logging.
- Enable advanced operating system logging in the adv.setup -> tools -> diagnostics
- Reproduce the issue
- After a while, disable logging
- Re-enable protected service and reboot the machine.
When done, collect logs with ESET Log Collector and add the Procmon log to the generated archive. Upload the archive to a safe location and drop me a personal message with a download link.
ChristianK received kudos from Peter Randziak in ESMC: Global process exclusion w/ placeholders