06-27-2020, 10:28 AM
no, -m 5600 is a diffrent format.
the pwdump is supported with -m 1000 = NTLM and -m 3000 = LM (also see https://openwall.info/wiki/john/hash-formats and https://ftp.samba.org/pub/samba/pwdump/README etc)
so either you are not using the correct -m value (most likely)... or your explanation/expectation about the NTLMv2 is wrong, see example hashes of -m 1000, -m 3000 and -m 5600 here: https://hashcat.net/wiki/example_hashes
the pwdump is supported with -m 1000 = NTLM and -m 3000 = LM (also see https://openwall.info/wiki/john/hash-formats and https://ftp.samba.org/pub/samba/pwdump/README etc)
so either you are not using the correct -m value (most likely)... or your explanation/expectation about the NTLMv2 is wrong, see example hashes of -m 1000, -m 3000 and -m 5600 here: https://hashcat.net/wiki/example_hashes