Re: Colour me stupid but...
I would assume so.
I have no idea as I'm not Technical... ah, well, sometimes I am. But I would guess, just as clicking "resource monitor" shows the actual program making the file request, this also works on the program level?
Though as noted above, it may just be one more step in the escalation to control the malware needs, it now needs to hijack another program in addition to credentials.