Windows 10 (⦿_⦿) I messed up firewall rules vs edge passwords

[zygi]

Hello,

I started to "play" with some services but mostly firewall rules (also local) and I've probably unlinked somehow Edge from It's credentials. Later on I've started Edge and there were few notices that It started with a new profile (bookmarks and favourites and even history was still there) but ALL MY PASSWORDS ARE GONE. There was also some update at night and I've seen Internet Explorer started without a reason. I've logged out from new profile but it didn't help.

I was able to go back to recovery point but it didn't help also.

I think this might be related somehow to Internet Explorer old services/credentials or Maybe I've locked time/date updates so the System couldn't get certificates or credentials and cleared my passwords? Some of them stayed in the profile folder but most are gone. Please help!

 

[Mike]

If you had synced your data to your MS account, its possible you could get your Edge passwords back on a different installation. Have you tried on a different computer? If not, there may be no such luck. There is a way to restore Windows services to default using a tool originally created by ESET, but no telling if that will solve your issue now that the damage is done. Have you considered trying to do a system restore back to before when you made these changes?

 

[zygi]

Hi,

a. No I haven't synced the data
b. I didn't make the system restore point but there were two already but it failed anyway

1. But I had some luck and managed to find file with the login/password data in:
C:\Users\XXXXXXX\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

2. I tried to extract it with Nirsoft WebpassViewer:

Recover lost passwords stored in your Web browser

Tool for Windows 10/8/7/Vista/XP to recover passwords stored by popular Web browsers (Chrome, Firefox, Edge, and others)

www.nirsoft.net

3. It showed logins and websites but no password for Edge (FF, Chrome are fine)

4. Strange thing - I started WebBrowserPassView v2.12 in a software called Sandboxie which was installed on my system to run apps more securely and in Sandboxie I got half of the passwords from Edge. I don't understand it.

5. I believe that there are some credentials missing. I tried software:
a) MadPassExt v1.00 (Microsoft Account DPAPI Password Extractor)
b) VaultPasswordView v1.11
but with no luck, I don't have this folder on my drive:
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\CloudAPCache\MicrosoftAccount

Im not sure what to do with this data anyway

6. I think this might be the resolution but I have no idea how to do it:

Protect folder is not containing any master key · Issue #328 · gentilkiwi/mimikatz

Hello, I followed the instruction of the how to but in my case within the protect folder in the SID folder I do not find anything is empty. Even if I create a new EFS certificate nothing land in th...

github.com

 

[zygi]

I managed to get the passwords back thanks to Sandboxie- pure luck. There were some credentials in it that were able to decode the passwords with WebBrowserPassView v2.12... 284 passwords are back. I still don't know what file Im missing on the system that is inside Sandboxie. If I wouldn't have Sandboxie installed before this happend it would be much harder