This entire attack revolves around failed DNS queries. Every windows environment by default has a DNS alternative to look for a file.