Could it be that the datastore path of SnagIt (we are not using 2018, but do have an older version running) is hardcoded?

Also keep in mind that anything in user context (so info in C:\USers and HKCU) is NOT stored in an appstack. If you do want to record this info use either UEM or a writable volume