When an application is running, it makes changes to the OS? How does AppZero capture those changes?

When running, all changes an application makes, including configuration changes, are captured within the VAA, leaving the underlying OS unchanged (unless specifically directed to do otherwise).