Opened 2 tabs on Edge and then another popped up that wanted me to verify through authentication without me doing anything that would call it to prompt. A little suspicious. Opened up Visual Studio 2022 to debug the authorization window that would not go away. I find that there is actually 7 instances of Webview, 6 instances of Windows.Client.WebExperience, and 11 general processes for Microsoft Edge (with no specific title). There is also an additional window that has the name of a window title attributed to it. Looking at the type of file, all of the Edge processes are listed as 64-bit, Javascript. Should I assume that there are several hidden Edge windows each running javascript?
Upon choosing a random windows, debugging fails with error message “Cannot connect to the target: connect ECONNREFUSED 127.0.0.1:9222” Why is visual studio trying to connect as a remote debugger through a TCP port?
All the connections for all of these processes have destinations listed as * in Sysinternals TCPView. I went to try wireshark and netstat. Some time while running those, I went back to TCPView and all the process IDs had changed to the same PID, even though I know they each had a unique PID before. How would a program be able to do this? What would be a foolproof way to track my destination IP address should this happen again?