If they persevere they can always compare the registry entries before and after install/run. Just encrypt the registry values.