Comparing differences between snapshots taken before and after running the executable shows all the system changes that happened. For this type of analysis, any events that happened in between are not identified. This is useful for finding out how a software installer installed a program. And as a result, the difference comes in handy, especially when manually uninstalling a piece of software. The tool used here is RegShot.