You're running into the problem described
here.
I don't think you actually need to turn off
tracking (mktNoTrack) but only turn off
tokenizing (mktNoTok) -- that way, you can still track the
Clicked Link in Email activity, but when the lead is redirected to your site for the download, there will be no extraneous query string.
That is, the problem isn't when the link gets rewritten to the branding domain as
http://pages.example.com/abcde
it's when the link
bounces off your branding domain and is tokenized on its way to your real domain as
http://download.example.com/file.exe?_mkt_tok=12345
Whereas with mktNoTok, it will just be
http://download.example.com/file.exe
after the redirection. That undecorated URL will be fine.