BlueHammer
Named by 2 kept items in this workspace.
1 items name it under classification.key entities and 1 under tools.
Search every workspace for BlueHammer. It matches the name as written, so it can find other things that share it.
The items that name it 2
Public PoC exploit (CVE-2026-33825) that abuses a TOCTOU race condition and Volume Shadow Copy freezing of Windows Defender to obtain a read handle on the SAM database, decrypt NT hashes, reset passwords, and escalate to SYSTEM.
All technologies in this workspace.