Get-CimInstance Win32_Process |
Where-Object {
$_.Name -match 'AnyDesk' -or
$_.ExecutablePath -match 'AnyDesk' -or
$_.CommandLine -match 'AnyDesk'
} |
Format-List ProcessId, ParentProcessId, Name, ExecutablePath, CommandLine, CreationDate

Get-CimInstance Win32_Service |
Where-Object {
$_.Name -match 'AnyDesk' -or
$_.DisplayName -match 'AnyDesk' -or
$_.PathName -match 'AnyDesk'
} |
Format-List Name, DisplayName, State, StartMode, StartName, PathName

Get-ChildItem `
'C:\ProgramData\AnyDesk*',
'C:\Users\*\AppData\Roaming\AnyDesk*',
'C:\Windows\Prefetch\*ANYDESK*.pf' `
-Force -Recurse -ErrorAction SilentlyContinue |
Sort-Object LastWriteTime |
Format-Table LastWriteTime, Length, FullName -AutoSize