Regshot: Before/After Diff

• Takes a snapshot of the registry and (optionally) the file system.
• Workflow: 1st shot (clean) -> detonate -> 2nd shot -> Compare.
• Output is a diff: keys added/deleted/modified, files added/deleted.
• Fast way to spot persistence keys and dropped files without reading a full Procmon trace.