This file is legitimate. It's linked to the TOR project. This version is used by the Wanacry ransomware.


MD5: fe7eb54691ad6e6af77f8a9a0b6de26d
SHA1: 53912d33bec3375153b7e4e68b78d66dab62671a
SHA256: e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

=> VirusTotal


CodeSize: 2344960
Directory: C \\Users\\user\\Desktop\\Tor
EntryPoint: 0x14e0
FileName: tor.exe
FilePermissions: rw-r--r--
FileSize: 3.0 MB
FileType: Win32 EXE
FileTypeExtension: exe
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit, No debug
ImageVersion: 1.0
InitializedDataSize: 3097600
LinkerVersion: 2.22
MachineType: Intel 386 or later, and compatibles
MIMEType: application/octet-stream
OSVersion: 4.0
PEType: PE32
Subsystem: Windows command line
SubsystemVersion: 4.0
TimeStamp: 2000 01 01 01 00 00+01 00
UninitializedDataSize: 18432

See also

  • taskhsvc.exe C \Users\user\Desktop\TaskData\Tor (Windows 7)