{
	"id": "e7c2e81f-04e3-4b88-b471-7657c5bbfc7d",
	"created_at": "2026-04-06T00:12:33.38862Z",
	"updated_at": "2026-04-10T03:30:14.879977Z",
	"deleted_at": null,
	"sha1_hash": "2cd7a476370dff162f8e26ce334b3e4791373727",
	"title": "Protected Storage PassView - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 43420,
	"plain_text": "Protected Storage PassView - Threat Group Cards: A Threat Actor\r\nEncyclopedia\r\nArchived: 2026-04-05 15:44:25 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Protected Storage PassView\r\n Tool: Protected Storage PassView\r\nNames Protected Storage PassView\r\nCategory Tools\r\nType Credential stealer\r\nDescription\r\nProtected Storage PassView is a small utility that reveals the passwords stored on your\r\ncomputer by Internet Explorer, Outlook Express and MSN Explorer. The passwords are\r\nrevealed by reading the information from the Protected Storage.\r\nStarting from version 1.60, this utility reveals all AutoComplete strings stored in Internet\r\nExplorer, not only the AutoComplete password, as in the previous versions.\r\nInformation \u003chttps://www.nirsoft.net/utils/pspv.html\u003e\r\nLast change to this tool card: 19 October 2020\r\nDownload this tool card in JSON format\r\nAll groups using tool Protected Storage PassView\r\nChanged Name Country Observed\r\nAPT groups\r\n  XDSpy [Unknown] 2011-Jul 2024  \r\n1 group listed (1 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=ef4693bc-72c1-4761-a414-89b2b8e02989\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=ef4693bc-72c1-4761-a414-89b2b8e02989\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=ef4693bc-72c1-4761-a414-89b2b8e02989"
	],
	"report_names": [
		"listgroups.cgi?u=ef4693bc-72c1-4761-a414-89b2b8e02989"
	],
	"threat_actors": [
		{
			"id": "69cba9ab-de35-4103-a699-7d243bcfd196",
			"created_at": "2023-01-06T13:46:39.159472Z",
			"updated_at": "2026-04-10T02:00:03.233731Z",
			"deleted_at": null,
			"main_name": "XDSpy",
			"aliases": [],
			"source_name": "MISPGALAXY:XDSpy",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "d69b3831-de95-42c9-b4b6-26232627206f",
			"created_at": "2022-10-25T16:07:24.429466Z",
			"updated_at": "2026-04-10T02:00:04.985102Z",
			"deleted_at": null,
			"main_name": "XDSpy",
			"aliases": [],
			"source_name": "ETDA:XDSpy",
			"tools": [
				"ChromePass",
				"IE PassView",
				"MailPassView",
				"Network Password Recovery",
				"OperaPassView",
				"PasswordFox",
				"Protected Storage PassView",
				"XDDown",
				"XDList",
				"XDLoc",
				"XDMonitor",
				"XDPass",
				"XDRecon",
				"XDUpload"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434353,
	"ts_updated_at": 1775791814,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/2cd7a476370dff162f8e26ce334b3e4791373727.pdf",
		"text": "https://archive.orkl.eu/2cd7a476370dff162f8e26ce334b3e4791373727.txt",
		"img": "https://archive.orkl.eu/2cd7a476370dff162f8e26ce334b3e4791373727.jpg"
	}
}