(02-14-2019, 10:21 AM)DanielG Wrote: Seeing as you are using -m 1000 it is likely you got a password dump in the format "krbtgt:502:aad3b435b51404eeaad3b435b51404ee:abcdef0123456789abcdef0123456789:::" or
"krbtgt:abcdef0123456789abcdef0123456789".
You need to make sure it looks like the example on https://hashcat.net/wiki/doku.php?id=example_hashes so just the abcdef0123456789abcdef0123456789 (NTLM hash) part.
Also ?I (capital i) is not a valid mask, you probably mean ?l (lowercase L).
Thanks DanienlG, i will check it
and by the way, does windows using NTLM to hash?