How to determine which IE tabs goes to which Iexplore.exe process when using Internet Explorer 8


Hi everyone!


Here’s an interesting bit of information for those tech geeks out there revolving around some of the changes in IE8 and loosely-coupled IE.


Due to the changes in LCIE for IE8, it can be very challenging to determine which IE tabs belong to which Iexplore.exe process.  If you are using Vista (or later), Task Manager has two column view options you can enable to help determine this:



  • Command Line which will display the folder location of the process being loaded along with any parameters

  • PID (Process Identifier) which will display the process number associated with the loaded process

With these two column view options enabled, you can see some pretty interesting stuff about IE8:


image


So, I loaded IE8 with a home page.  However, from within the Task Manager UI, I can see two Iexplore.exe processes (32bit).  If you’ve read up on LCIE, then you’ve probably got a leg up on most folks on why, but let’s go over it.  The lower Iexplore.exe process is the first process (initial frame process) that gets loaded when the IE icon is clicked on the desktop.  The top Iexplore.exe process (tab process) is loaded next because this loads the web site that I have setup as my home page.  Now, I will open a second tab to see what shows up within the Task Manager UI:


image


Ok, so now I have three Iexplore.exe processes open and all I did was open a new tab with no web site even loaded within that tab.  If you look at the image closely, you will see some associations – most notably the number 2688.  Actually, you see it in three different locations:



  1. The first Iexplore.exe frame process with a process ID of 2688

  2. The first tab process that loaded my home page, SCODEF:2688 CREDAT:71937

  3. The second tab process that I opened which has no web site loaded, SCODEF:2688 CREDAT:6402

So the process ID is the link that tells us which IE tabs go to which IE process.  In short, The SCODEF parameter for each tab refers to the PID of its frame process so PID 872 and 5440 are child IE tab processes of the PID 2688 IE frame process.  Pretty cool!


So let’s say you actually need to know which IE tab within the UI matches up to which process you see within Task Manager.  How would you accomplish this?  Unfortunately, it’s not as straight forward.  You’ll need to use another tool that can give you some specific information about each individual IE tab so that you can associate the IE tab process to the IE tab you are looking at within the IE User Interface of IE8.  The tool I used is called Process Explorer.  This tool has the option to click on a window and gather some useful information from it using this option:


image


If you click on the option (radar icon) highlighted in red and then drag it over on the IE Tab you are interested in, then Process Explorer will associate the IE Tab you see with the IE Tab that is listed within the Process list within Process Explorer:


image


Note: You will need to drag and drop the radar icon on the area of the tab highlighted in red to get the correctly associated IE tab:


image


Well, that’s about it.  Hope this information was interesting and helpful for you…


Regards,


The IE Support Team


Comments (11)

  1. Fernando Fonseca says:

    An about the CREDAT parameter, what it means?

  2. Lea Daniel says:

    When I try to open internet explorer Norton 360 says a process is trying to launch a target process scodef:3812 CREDAT 71937.  Is this a security risk?  Thank you very much!

  3. Janice Jones says:

    When one of the instances takes up 2/3 of my memory (taskmaster), do I have malware?

    jjones50@neb.rr.com

  4. Janice Jones says:

    When one of the instances takes up 2/3 of my memory (taskmaster), do I have malware?

    jjones50@neb.rr.com

  5. Doug Lake says:

    Internet Explorer 8 and Task Manager Processes

    CUSTOMER PROVIDED SYSTEM PROPERTIES

    O/S: Vista Ver 6.0 (Build 6.2; Service Pack 2)

    Br: Internet Explorer 8.0.6001.18904IC

    CONTACT INFORMATION

    First Name: Doug

    Last Name: Lake

    E-Mail: snohomishdoug@aol.com

    PRODUCT

    Windows Vista;Internet Explorer 8

    QUESTIONS OR COMMENTS

    Message:I have 2 users setup using Vista on this computer.  My sessions of explorer all close out when I close explorer.  However using Windows Task Manager and clicking on the Proccess tab, User 2's processes stay active after closing explorer.  Sometimes there are more than 65 processes going at once.  What can I do to aleiveate this issue.  I've setup her settings just like mine and it still does it.  Tying up resources and memory.  I do realize I need to purchase more memory, however, that is not the problem right now.  Thank you for your attention.

    Doug Lake

  6. Craig says:

    You can just hover your mouse over the iexplore.exe instances in process explorer and the tool tip balloon will tell you which tab is which

  7. Burda says:

    i am having a problem….

    so if i have 2 iexplorer.exe

    1. "C:Program FilesInternet Exploreriexplore.exe"

    2."C:Program FilesInternet Exploreriexplore.exe" SCODEF:1984 CREDAT:79873

    is the second instance a virus ? it wont bring itself too the front. i abben racking my head to find out how to kill it , i have talked to 2 other IT friends and even let them look on teamviewer all were dumbfounded…. i knoticed this when i got called in for what i thought was a simple HIJACKED browser… run a few scans and be done with it . then i saw it on 6 of the 7 PCs… not sure if the 7th pc just had an old IE or what … so have i been going crazy for hours for no reason … PLEASE HELP I AM OUT OF THOUGHTS

    Sburda1k at Yahoo.com

  8. Tome Tanasovski says:

    Thanks for the info.  I built on it a bit – posted a bit of PowerShell to help you associate the pid with your tab without needing process explorer.

    powertoe.wordpress.com/…/finding-the-thread-pid-that-belongs-to-a-tab-in-ie-8-with-powershell

  9. mike simore says:

    so …………..

    iexplore.exe *32 with scodef and credat is normal ?

    and not a virus or something like that ????

    plz answer

  10. TD Thomas says:

    This seems to be a very common concern!  Why isn't anyone within 'The IE Support Team' answering these questions???

    Are these multiple instances (my computer has 4 to 5 right now) of iexplore.exe…SCODEF normal?  Or are they signs of some kind of malware?

    Please do not ignore this — please answer!

  11. axelr says:

    @TD Thomas

    IE8 and above will start with two instances of iexplore.exe (one for the Frame, one for the tab) and grows the number of tab processes as needed based on the amount of available RAM, the number of tabs, the integrity levels for tabs, and the number of distinct IE sessions. These distinct IE Sessions have the SCODEF:xxxx CREDAT:xxxxxx associated to it to help identify the process/components. The  SCODEF:[pid of frame]

    loading under the IExplore.exe identifies the tab process.

    In normal, IE operations I would not worry about this unless you are seeing big performance issues or suspect of a malware or virus infection, which is possible. I would recommend to consider using Process Explorer as a tool to help you look underneath the process and see if this helps you find anything. If you need further assistance, consider opening a Microsoft Support ticket.

    Process Explorer Download:

    technet.microsoft.com/…/bb896653.aspx