He has a tool that checks for accesses on specific kinds of files and he uses that and a few specially crafted files to see what happens. That tool might even influence other processes for all we know.

How does a security researcher not know about procmon? another user here did a test and found no problems.