# procmon

Silent Process Monitor trace capture — saves process/file/registry/network events to a PML file. Uses bundled Procmon64.exe from C:/USB/system/procmon/.

## Structure

- `schema.json`: Interface
- `tool.py`: CLI
- worker.py: Background
