Maybe it depends on the mask you use in step #1 ?
It's difficult to say without a more detailed example for each step.
As you might have already noticed, hashcat prefers a mask attack (see https://hashcat.net/wiki/mask_attack ) over a "full-bruteforce" attack. But the settings for this mask attack (aka the mask itself) is very crucial to understand what should be cracked and what not.
Maybe you can provide for each step the full command and also the password (we do not yet need the hash, because it should be easy to generate the hash and it's actually prohibited to post hashes here without the admin requesting it).
It would also be interesting to know if this only happens with multi-hashes or with a single hash too.
Thanks
also note: one particularity of NTML is that it uses UTF-16 (little endian) so the password length is actually doubled (see https://hashcat.net/faq#what_is_the_maxi...ord_length for maximum password length)
It's difficult to say without a more detailed example for each step.
As you might have already noticed, hashcat prefers a mask attack (see https://hashcat.net/wiki/mask_attack ) over a "full-bruteforce" attack. But the settings for this mask attack (aka the mask itself) is very crucial to understand what should be cracked and what not.
Maybe you can provide for each step the full command and also the password (we do not yet need the hash, because it should be easy to generate the hash and it's actually prohibited to post hashes here without the admin requesting it).
It would also be interesting to know if this only happens with multi-hashes or with a single hash too.
Thanks
also note: one particularity of NTML is that it uses UTF-16 (little endian) so the password length is actually doubled (see https://hashcat.net/faq#what_is_the_maxi...ord_length for maximum password length)