Depending on how it was cracked, maybe.

One of the more recent cracks would be autoKMS which would emulate having a key management server and redirecting all activation requests to itself. You could see that service running and the associated files.

If they are using stolen MAK keys, it’s unlikely.