__utma means they were looking for Google Analytics cookies. If you weren't on the landing page after seeing the ad (and just opened the zip file) you wouldn't have these on your test page. Also:
$ base64 -d
dj01MDY1NDg3MTIwZTU2ZmQ1ZTZlNCZjaWQ9MjY0
v=5065487120e56fd5e6e4&cid=264
cid= is common for campaign identifiers. Might also be "channel". This might not be a CNC system but ad fraud.
Using a coffee shop is a great idea, but perhaps one further away from Tyson's Corner since there are a lot of IP addresses there used by netsec people and servers, so they are on a lot of blocklists.
Sometimes the script is looking for special cookies when injecting onto sites like amazon, so I used to use gift cards to buy stuff on amazon on my testrig when examining some malware, and I would get much more interesting ads than without.
Also: Be careful when recording your SSL traffic (with something like MITMPROXY), since ad guys know about this: https://github.com/mitmproxy/mitmproxy/issues/4575 but a lot of netsec people forget about this.
Using a coffee shop is a great idea, but perhaps one further away from Tyson's Corner since there are a lot of IP addresses there used by netsec people and servers, so they are on a lot of blocklists.
Sometimes the script is looking for special cookies when injecting onto sites like amazon, so I used to use gift cards to buy stuff on amazon on my testrig when examining some malware, and I would get much more interesting ads than without.
Also: Be careful when recording your SSL traffic (with something like MITMPROXY), since ad guys know about this: https://github.com/mitmproxy/mitmproxy/issues/4575 but a lot of netsec people forget about this.