06-27-2020, 11:50 AM
Hmh... yes. If I take just the 25bxxxxxxxxxxxxxxxxxxxxxxxxxxb4b part and hashcat with -m 1000, it starts the job. And now, after learning to read, it does say on m 5600 that it is a NetNTLMv2 not NTLMv2. I got the hash from an image using volatility.