anydesk forensics

Get-CimInstance Win32_Process |
    Where-Object {
        $_.Name -match 'AnyDesk' -or
        $_.ExecutablePath -match 'AnyDesk' -or
        $_.CommandLine -match 'AnyDesk'
    } |
    Format-List ProcessId, ParentProcessId, Name, ExecutablePath, CommandLine, CreationDate

Get-CimInstance Win32_Service |
    Where-Object {
        $_.Name -match 'AnyDesk' -or
        $_.DisplayName -match 'AnyDesk' -or
        $_.PathName -match 'AnyDesk'
    } |
    Format-List Name, DisplayName, State, StartMode, StartName, PathName

Get-ChildItem `
    'C:\ProgramData\AnyDesk*',
    'C:\Users\*\AppData\Roaming\AnyDesk*',
    'C:\Windows\Prefetch\*ANYDESK*.pf' `
    -Force -Recurse -ErrorAction SilentlyContinue |
    Sort-Object LastWriteTime |
    Format-Table LastWriteTime, Length, FullName -AutoSize