@cryp#129045 I doubt they put anything else into this, the file size is the same as the original and I was able to edit the splashscreen just as easy as they did, with a simple edit of 2 files, the logo.png and branding.ini.
They might have preset some settings, but I did not find any other “extra” files.
When I come across that I will use wireshark to grab the IP and see which one it grabs, since then I can get the ISP abuse email and email them regarding the issue and get it taken down.