I am trying to find out if any http requests are made during installation of an msi package. It appears to me that the process under which the http request is made shares no lineage with the process under which the installer executes.

For example, I install an app that makes http calls during installation. Using SysInternals process monitor, I see the process created when the install kicks off. Using MS NetworkMonitor I can see the process used to generate the http request. Filtering in Process Monitor after the fact shows that there is no relationship between the http process, and the install process.

I am thinking that somehow the OS says to use a new process whenever an http request is made. My most important requirement is that I be able to relate one to the other, in order to definitively say "This app installation called these http resources during install". So I don't have to have a perfect understanding of how it all works under the covers, but, I am at a standstill right now. I've concluded that there is no way to relate the two. Am I wrong?