Here's an annotated version of the code: http://pastebin.mozilla.org/2777139 http://pastebin.mozilla.org/2777139 It includes a hexdump of the shell code, showi

Here's an annotated version of the code: http://pastebin.mozilla.org/2777139 http://pastebin.mozilla.org/2777139 It includes a hexdump of the shell code, showing it's building an HTTP request to somewhere. So it's likely identifying Tor users through non-Tor connections.