What a stupid guy

That's probably a VNC/local server listener.

tor listens for socks on 9050 by default. tor uses 5400 as the default DNS port.