I cannot interrogate a web based application popup that saves a file. I am able to interrogate the main web application just not the popup. During my analysis of this issue I used Process Explorer to determine the process that the pop up is associated with. I discovered that there are two iexplorer processes. The bottom level is the one I am able to interrogate. The top level, associated with the popup I cannot interrogate. Please refer to attached pictures of the Process Explorer clip showing the two processes. Also attached is a picture of the popup. I tried adding a second adapter that I set StartMethod = MonitorAll, HookChildProcess=True and StartPage = C:\Program Files\internet explorer\iexplore.exe, which is the exe that Process Explorer indicates the popup is associated with. I am able to hook and interrogate iexplorer processes that I start manually but I am unable to hook the top iexplorer process shown associated with the popup.

Any ideas?