anti-RAT/Malware

this is the website that the data get fetched from (uses some temporary tokens to prevent curious visitors)
garbanius.com
if you have the same problem Here's a solution that'll keep you safe until i find the responsible resource/code
got to your firewall and blacklist the following ips
172.67.198.71
104.21.21.109
if this solution worked you should be safe and the malware will not be downloaded (unless the change the ips)