I haven't looked in to this or the Windows 10 stuff. When I read that something in vanilla windows 10 installs wipes pirated software I figured at the very least the warez scene would RE it and release some background-process based tool. It's probably not obfuscated or protected by a driver, probably just inline patching some windows service.
This python script probably uses the native API modules and patches something besides the host file.