Outlook Analysis
Target OS: Windows
Relevance 1:
(name of it = "WinXP" OR name of it = "WinXP-2003" OR (name of it = "WinVista" AND product type of it = nt workstation product type AND NOT x64 of it) OR (name of it = "WinVista" AND product type of it = nt workstation product type AND x64 of it) OR (name of it = "Win7" AND NOT x64 of it) OR (name of it = "Win7" AND x64 of it)) of operating system
Relevance 2:
exists keys whose (value "DisplayName" of it as string as lowercase contains "Outlook" as lowercase) of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of registry OR exists keys whose (value "DisplayName" of it as string as lowercase contains "Outlook" as lowercase) of key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of native registry
Properties:
# of all email accounts on computer
(not accurate, seems to include accounts that have been deleted)
if exists keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" of keys of key "HKEY_USERS" of registry then number of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" of keys of key "HKEY_USERS" of registry as string else "No Outlook installed"
# of POP accounts on computer
number of values "POP3 Server" of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" of keys of key "HKEY_USERS" of registry as string
# of IMAP accounts on computer
number of values "IMAP Server" of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" of keys of key "HKEY_USERS" of registry as string
POP3 Server
hexadecimal strings (concatenation of ((hexadecimal integer (last 2 of it & first 2 of it) as hexadecimal) as string) of firsts 4 of following texts of positions whose ( it mod 4 = 0 ) of (preceding texts of lasts "0" of (value "POP3 Server" of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" of keys of key "HKEY_USERS" of registry as string)))
PST Files
concatenation ", " of (if exists regapp "outlook.exe" then if version of regapp "outlook.exe" = "10" then (if (exists values whose (it as string contains ".pst") of keys of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" of keys of keys "HKEY_USERS" of registry) then ((pathname of it & " - " & (size of it / (1024*1024)) as string & "Mb") of files ((values whose (it as string contains ".pst") of keys of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" of keys of keys "HKEY_USERS" of registry) as string)) else ("No archive")) else if version of regapp "outlook.exe" >= "11" then (if (exists (Values "001f6700" of keys of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" of keys of key "HKEY_USERS" of registry as string)) then (((pathname of it & " - " & (size of it / (1024*1024)) as string & "MB") of files ((hexadecimal strings (concatenation of ((hexadecimal integer (last 2 of it & first 2 of it) as hexadecimal) as string) of firsts 4 of following texts of positions whose (it mod 4 = 0) of it)) of (preceding texts of lasts "0" of (Values "001f6700" of keys of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" of keys of key "HKEY_USERS" of registry as string)) as string))) else ("No Archive")) else "Outlook < XP installed" else "Outlook not installed")
References: