Tracing Tor router connections within a host

Hi there,

I'm analysing a memory dump from an infected system that is running a cryptominer and connecting to the mining server through a Tor router.

I know the processes of the miner and the tor router it installed on the system. Is there a way to show the miner handing over the IP of the actual mininf server to the Tor router?

The firewall of course just sees the connection to the next Tor router.

computerforensics host router tor tracing