IE pop-up window: Fiddler, process dump, Process Monitor and IEDigest

Download Fiddler from https://www.telerik.com/download/fiddler and install it.

Open Fiddler and go to Tools -> Options -> HTTPS tab. Enable Decrypt HTTPS traffic. You will be prompted to install the Fiddler Root certificate (this step requires elevated permission).

Close Fiddler.

Download IEDigest from https://aka.ms/iedigest and extract iedigest.exe from the zip file.

Download and unzip Process Explorer from https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer.

Download and unzip Process Monitor from https://learn.microsoft.com/en-us/sysinternals/downloads/procmon.

Press the Win key + R or right click on the Start Menu and choose Run to launch a Run dialog. Then run inetcpl.cpl to open Internet Properties.

In the General tab, click Delete button.

• Uncheck Preserve Favorites website data.
• Check Temporary Internet files and website files.
• Check Cookies and website data.
• Click the Delete button.
• Wait until the deleting is completed and then you can close the Internet Properties window.

Start Fiddler. It should automatically start capturing, and you will see Capturing icon in the lower left corner. If it is not capturing, press F12 to start capturing.

Launch Procmon.exe as administrator from the location where you unzipped the Process Monitor. It should automatically start capturing after startup. Proceed to the next step when you see that it is generating a large number of events.

Press Win key + R or right click the Start Menu and choose Run to launch a Run dialog and run the command: iexplore.exe <URL> to open IE with a specific URL. For example, to launch IE to access https://www.microsoft.com/, you can run iexplore.exe https://www.microsoft.com/

Do whatever steps to reproduce the pop-up window in IE. Once the pop-up window appears, please DO NOT close it and proceed to next step.

Launch procexp.exe as administrator from the location where you unzipped Process Explorer.

Left click and hold the Find Window's Process button and drag it over the pop-up window. Then, release your mouse. Process Explorer will automatically identify and highlight the process that is responsible for the pop-up window.

Right click the highlighted process and select Create Dump from the menu, then choose Create Full Dump... to create a full dump of the process.

Go to Process Monitor, press Ctrl+E or click the third Capture icon to stop capturing.

Click File -> Save. Choose All events and then save the log in pml format.

Go to Fiddler -> File -> Save -> All Sessions... to save the file in saz format.

Run iedigest.exe from the location where you extracted it.

Click the Create report button and wait until it completes.

The log will be saved to a folder named IEDigest on the user's desktop (%userprofile%\Desktop\IEDigest)