Fusion's virtual hardware won't log the requester, only that it was requested and presented you the dialogue, you'll need to check your guest logs.

To give a comparison, a physical NIC doesn't log anything, it just does what it's told.

How you figure it out tho could go from something simple like:

- use fusion until you get the message

- Examine all running processes in Windows, google anything you don't know about

To something as involved as the following:

- let the operation succeed ('allow' the promiscuous mode to enable)

- Use vmnet-sniffer to capture all the packet data from the host on the vmnet you're using

- analyze the pcap data with wireshark to understand what it's actually doing.

The latter is an exercise in really low level packet analysis and is not for the faint of heart, but if you know what you're doing (or are willing to do the research) it will tell you what's going on with no holds barred.