anydesk forensics

Get-CimInstance Win32_Process |
    Where-Object {
        $_.Name -match 'AnyDesk' -or
        $_.ExecutablePath -match 'AnyDesk' -or
        $_.CommandLine -match 'AnyDesk'
    } |
    Format-List ProcessId, ParentProcessId, Name, ExecutablePath, CommandLine, CreationDate

Get-CimInstance Win32_Service |
    Where-Object {
        $_.Name -match 'AnyDesk' -or
        $_.DisplayName -match 'AnyDesk' -or
        $_.PathName -match 'AnyDesk'
    } |
    Format-List Name, DisplayName, State, StartMode, StartName, PathName

Get-ChildItem `
    'C:\ProgramData\AnyDesk*',
    'C:\Users\*\AppData\Roaming\AnyDesk*',
    'C:\Windows\Prefetch\*ANYDESK*.pf' `
    -Force -Recurse -ErrorAction SilentlyContinue |
    Sort-Object LastWriteTime |
    Format-Table LastWriteTime, Length, FullName -AutoSize
✅ Leaked Exploit Documentation:

https://docs.google.com/document/d/1EaaVyJWSr4MWFyCREwVIuc8aE8hOEbCnQ5B31P5tQU0

This made me 3,000 in 2 days.

Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 25% — they will simply correct the exchange rate.
The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.

Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without verification from SimpleSwap — instant swap).