SharpDPAPI

SharpDPAPI is a C# port of Mimikatz DPAPI functionality for locating, deriving, and decrypting user and machine DPAPI masterkeys and protected data such as credentials, vaults, Remote Desktop Manager data, and certificates. Its backupkey command retrieves the domain DPAPI backup private key, which can decrypt any domain user's masterkeys. Machine triage requires an already elevated local Administrator process and retrieves DPAPI_SYSTEM under SYSTEM context; it covers machine masterkeys, credentials, vaults, certificate private keys, and SCCM Network Access Account credentials when the local SCCM WMI namespace and class are available. Browser credential triage is provided by the separately built SharpChrome executable.