Analysis | Outlook

PST Files

Period 12 hours

* Results in a "string"/number

concatenation ", " of
(
    if exists regapp "outlook.exe" then if version of regapp "outlook.exe" = "10" then
    (
        if
        (
            exists values whose
            (
                it as string contains ".pst"
            )
            of keys of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" of keys of keys "HKEY_USERS" of registry
        )
        then
        (
            (
                pathname of it & " - " &
                (
                    size of it /
                    (
                        1024*1024
                    )
                )
                as string & "Mb"
            )
            of files
            (
                (
                    values whose
                    (
                        it as string contains ".pst"
                    )
                    of keys of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" of keys of keys "HKEY_USERS" of registry
                )
                as string
            )
        )
        else
        (
            "No archive"
        )
    )
    else if version of regapp "outlook.exe" >= "11" then
    (
        if
        (
            exists
            (
                Values "001f6700" of keys of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" of keys of key "HKEY_USERS" of registry as string
            )
        )
        then
        (
            (
                (
                    pathname of it & " - " &
                    (
                        size of it /
                        (
                            1024*1024
                        )
                    )
                    as string & "MB"
                )
                of files
                (
                    (
                        hexadecimal strings
                        (
                            concatenation of
                            (
                                (
                                    hexadecimal integer
                                    (
                                        last 2 of it & first 2 of it
                                    )
                                    as hexadecimal
                                )
                                as string
                            )
                            of firsts 4 of following texts of positions whose
                            (
                                it mod 4 = 0
                            )
                            of it
                        )
                    )
                    of
                    (
                        preceding texts of lasts "0" of
                        (
                            Values "001f6700" of keys of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" of keys of key "HKEY_USERS" of registry as string
                        )
                    )
                    as string
                )
            )
        )
        else
        (
            "No Archive"
        )
    )
    else "Outlook < XP installed" else "Outlook not installed"
)

concatenation ", " of (if exists regapp "outlook.exe" then if version of regapp "outlook.exe" = "10" then (if (exists values whose (it as string contains ".pst") of keys of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" of keys of keys "HKEY_USERS" of registry) then ((pathname of it & " - " & (size of it / (1024*1024)) as string & "Mb") of files ((values whose (it as string contains ".pst") of keys of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" of keys of keys "HKEY_USERS" of registry) as string)) else ("No archive")) else if version of regapp "outlook.exe" >= "11" then (if (exists (Values "001f6700" of keys of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" of keys of key "HKEY_USERS" of registry as string)) then (((pathname of it & " - " & (size of it / (1024*1024)) as string & "MB") of files ((hexadecimal strings (concatenation of ((hexadecimal integer (last 2 of it & first 2 of it) as hexadecimal) as string) of firsts 4 of following texts of positions whose (it mod 4 = 0) of it)) of (preceding texts of lasts "0" of (Values "001f6700" of keys of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" of keys of key "HKEY_USERS" of registry as string)) as string))) else ("No Archive")) else "Outlook < XP installed" else "Outlook not installed")

# of all email accounts on computer

Period 6 hours

* Results in a "string"/number

if exists keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" of keys of key "HKEY_USERS" of registry then number of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" of keys of key "HKEY_USERS" of registry as string else "No Outlook installed"

# of POP accounts on computer

Period 6 hours

* Results in a "string"/number

number of values "POP3 Server" of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" of keys of key "HKEY_USERS" of registry as string

# of IMAP accounts on computer

Period 6 hours

* Results in a "string"/number

number of values "IMAP Server" of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" of keys of key "HKEY_USERS" of registry as string

POP3 Server

Period 6 hours

* Results in a "string"/number

concatenation of hexadecimal strings (concatenation of ((hexadecimal integers (last 2 of it & first 2 of it) as hexadecimal) as string) of firsts 4 of following texts of positions whose ( it mod 4 = 0 ) of (preceding texts of lasts "0" of (values "POP3 Server" of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" of keys of key "HKEY_USERS" of registry as string)))

Outlook Profile access mode

Period 12 hours

* Results in a "string"/number

(
    effective access mode for
    (
        name of current user
    )
    of dacl of security descriptor of folder
    (
        unique value of pathnames of parent folders of files
        (
            (
                hexadecimal strings
                (
                    concatenation of
                    (
                        (
                            hexadecimal integer
                            (
                                last 2 of it & first 2 of it
                            )
                            as hexadecimal
                        )
                        as string
                    )
                    of firsts 4 of following texts of positions whose
                    (
                        it mod 4 = 0
                    )
                    of it
                )
            )
            of
            (
                preceding texts of lasts "0" of
                (
                    Values "001f6700" of keys of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" of key
                    (
                        "HKEY_USERS\" &
                        (
                            name of key whose
                            (
                                (
                                    (
                                        it = name of current user as lowercase OR it starts with name of current user as lowercase & "@"
                                    )
                                    of
                                    (
                                        it as string as lowercase
                                    )
                                    of
                                    (
                                        if
                                        (
                                            name of operating system = "Win7"
                                        )
                                        then value "USERNAME" of key "Volatile Environment" of it else value "Logon User Name" of key "Software\Microsoft\Windows\CurrentVersion\Explorer" of it
                                    )
                                )
                            )
                            of key "HKEY_USERS" of registry
                        )
                    )
                    of registry as string
                )
            )
            as string
        )
        as string
    )
)
as string

(effective access mode for (name of current user) of dacl of security descriptor of folder (unique value of pathnames of parent folders of files ((hexadecimal strings (concatenation of ((hexadecimal integer (last 2 of it & first 2 of it) as hexadecimal) as string) of firsts 4 of following texts of positions whose (it mod 4 = 0) of it)) of (preceding texts of lasts "0" of (Values "001f6700" of keys of keys of keys "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles" of key ("HKEY_USERS\" & (name of key whose (((it = name of current user as lowercase OR it starts with name of current user as lowercase & "@") of (it as string as lowercase) of (if (name of operating system = "Win7") then value "USERNAME" of key "Volatile Environment" of it else value "Logon User Name" of key "Software\Microsoft\Windows\CurrentVersion\Explorer" of it))) of key "HKEY_USERS" of registry)) of registry as string)) as string) as string)) as string

MailTo:

Period 12 hours

* Results in a "string"/number

value "" of key "HKEY_CLASSES_ROOT\mailto\shell\open\command" of registry

HKCU Mailto Override

Period 12 hours

* Results in a "string"/number

exists keys "Software\Microsoft\Windows\Shell\Associations\UrlAssociations\mailto" of keys of key "HKEY_USERS" of registry

Search for:	Relevance	Fixlets/Tasks
	Analyses	BFI Signatures
	Dashboard/Wizard

Title	Keywords	Description
Relevance	Domain	ActionScript
Mime	Signature Content	(clear all)

ID	51
Title	Outlook
Domain	BESC
Keywords	Outlook, Windows
Added by	jgstew on 11/29/2012 10:34:08 AM
Last Modified by	jgstew on 11/29/2012 10:34:08 AM
Counters	8312 Views / 84 Downloads
User Rating	* Average over 1 rating. ** Log In or Register to add your rating.


Content Search Share Learn Projects	Utilities View SCM Scripts Base64 Converter Shell to Action Script	About About Us Tour FAQ Terms Contact Us	BigFix Resources Download BigFix Support Forum Github/Bigfix

Outlook
Log In or Register to download the BES file, and more.

Description

Property Details

Properties

Relevance

Sharing

Comments

Content

Utilities

About

BigFix Resources

Outlook Log In or Register to download the BES file, and more.

Description

Property Details

Properties

Relevance

Sharing

Comments

Content

Utilities

About

BigFix Resources

Outlook
Log In or Register to download the BES file, and more.