I am seeking clarification regarding the service connections associated with tor.exe.
Disclaimer: I don’t know much about Tor it was downloaded by mistake.
Observed Sequence of Events:
- Event 1 (10:00:12 AM) – tor-browser-windows-x86_64-portable-13.5.1.exe was downloaded, installed, and executed.
- Event 2 (10:02 AM, exact milliseconds unavailable) – tor.exe established four service connections. Example of service connection: www[.]9jkla0873di[.]com
- Event 3 (10:02:22 AM) – firefox.exe was executed, as indicated by the accessed file (LNK) at:
C:\Users\username\Tor Browser\Browser\firefox.exe - Event 4 (10:22 AM, exact milliseconds unavailable) – tor.exe established nine service connections. Example of service connection: www[.]9jkpsue665ei[.]com
- Event 5 (10:22:33 AM) – lyrebird.exe was executed, as indicated by the Program Execution (Shim Cache) at: C:\Users\username\Tor\Browser\Browser\torbrowser\tor\pluggabletransports\lyrebird.exe
Request for Insights:
- Could the tor.exe connections in Event 2 have been automatically triggered by Event 3 (firefox.exe execution)?
- Similarly, could the tor.exe connections in Event 4 have been triggered by Event 5 (lyrebird.exe execution)?
- Are these tor.exe connections indicative of automatic background processes, meaning no user-initiated browsing activity occurred?
- Alternatively, do these connections suggest intentional user activity within the Tor browser?
Any insights, technical references, or forensic findings that could clarify this behavior would be greatly appreciated.