password found but exhausted !!

[captainAfrica]

It's because of the "Recovered" line, only 2 of 3 are found

Code:

Recovered........: 2/3 (66.67%) Digests

This could mean several things, but most likely that your file oor.hccapx doesn't contain only one network, but multiple.

In theory there could also be the case that you recorded a handshake that only deals with one specific network (and access point AP, if we oversimplify it a little bit) but the recorded handshake was recorded when somebody (or a device) used the wrong password or something like this.... so there are multiple scenarios. I'm pretty sure if you use the recommend way of capturing the network traffic with hcxdumptool / hcxtools a lot of incomplete and wrong handshakes are already identified and only the correct/meaninful ones are within the hccapx output. So you should probably use that way of capturing.

Of course you would need to analyze the .hccapx file (also see https://hashcat.net/wiki/doku.php?id=hccapx and you could use hcxtools also here) to find out which (different ?!) networks are listed in the oor.hccapx file.

So hashcat has found 2 of 3 correct matches and therefore it's correct that it reports that NOT ALL of them are cracked and therefore it's exhausted with 2/3 cracked hashes.

thank you very much PHIL  you explain me a lot of the things
I will execute your advice and try the methods that you recommended to me .
the way I use to capture handshake is The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali) linux airodump-ng + aireplay-ng.  is that a bad thing ??
is hcxdumptool better than airodump-ng ??
thank you again