10 years to crack a 13 character password?

[royce]

That's not quite how specifying a mask works. IF you don't know which characters are in which positions, you want something more like this -- first definiting a custom character set, and then using it:

-2 ?u?d ?2?2?2?2?2?2?2?2?2?2?2?2?2

I used "2" here for legibility; you can specify up to four custom character sets.

More info here:

https://hashcat.net/wiki/doku.php?id=mask_attack