From memory, in addition to sticking some pseudo-randomly named files in /System/Library, /Library, and -/Library, it would place a file in the root directory of all hfs+ volumes with xattrs set to hide and write-protect the file. Installers would then look for these files to check licensing status.

At the time, this was a fairly common trick with pro/prosumer proprietary software.