>They know exactly what they’re doing.

Strongly disagree. If they installed this to do some analysis they would have done that in a VM if they “knew exactly what they were doing”.

Either you snared a script kiddy, or your software download and install process that followed that google ads click was highly questionable.

I think it´s obvious from the browser history in the blog posting that script kiddy is for sure