hashcat Forum

If you want to bruteforce, the command needs to be:
cudaHashcat-plus64.bin -m 1000 -a 3 -o cracked.out ntlmhash.txt ?l?l?l?l?l?l?l?l

That will cover keyspace of 8--all lowercase (aaaaaaaa-zzzzzzzz). Adjust for however long a keyspace you want to try.

Your previous commands only had "?1?1?1?1" and "a" repectively in the dictionary which hashcat happily appended the character mask you specified afterward.

Excellent! That worked. Caveat is I need to recursively increase the keyspace if I want to bruteforce from 1-10 characters.

Thanks for all the help everyone.