Problem with Hashcat and mscash2
hi folks and thanks for letting me be part of the forum Smile

i am trying to use hashcat on windows 8.1 x64
for penetrationtesting in the company where i am one of the sysadmins i have extracted a domain cached credential and my file is in this format (one per line)

user:hash:domainname:domainshortcut(i dont know what this field is):::

i am using the hashcat gui from
after i load the file and set up everything it is generating me this command:

hashcat64.exe -a 0 -m 2100 --session=all -p : --status --status-timer=60 -o "mycashfile.txt_found2100.txt" --outfile-format=3 -w 2 --gpu-temp-abort=80 "mycashfile.txt" "rockyou.txt"

when i run this command i get this error:

WARNING: Hashfile 'mycashfile.txt' on line 1 (user:hash:domainname:domainshortcut::Smile
: Line-length exception
WARNING: Hashfile 'mycashfile.txt' on line 2 (user:hash:domainname:domainshortcut::Smile
: Line-length exception
WARNING: Hashfile 'mycashfile.txt' on line 3 (user:hash:domainname:domainshortcut::Smile
: Line-length exception
WARNING: Hashfile 'mycashfile.txt' on line 4 (user:hash:domainname:domainshortcut::Smile
: Line-length exception
Parsed Hashes: 4/4 (100.00%)

ERROR: No hashes loaded

i have tried format mscash and mscash2

i have also tried using JTR with mscash2 and there its parsing the hashes so they are ok. i guess there is an error in my syntax.

any help would be appreciated Smile
Here's an example -m 2100 hash:

thanks for the tip.
so far here is where i am:

since its a test i know one of the passwords so i have put it in my worldlist around line 2000
to verify if it will actually work.

i made 2 test files:

file1 is containing the hash as i had it already in this format:

in file2 i used the test hash you gave me and exchanged username und hash with the known one from file1
my hash and your testhash have the same length

on my following tests with JTR and hashcat i used format mscash2 on all tests

JTR and file1: process is starting and after a moment its succesfully showing me the password
JTR and file2: process is starting but no password is found

hashcat and file1: process is starting but no password is found
hashcat and file2: same error as in 1st post for sure

seems like hashcat and JTR have a different understanding of the format mscash2??

so the question is how can i dump DCC in the format hashcat needs?

i dumped the hashes i use now with the from here

then i also tried the cachedump in The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali) linux
http://tools.The-Distribution-Which-Does-Not-Handle-OpenCL-Well (Kali).org/password-attacks/creddump
but there i get an error which seems to be a known bug

so how can i dump the DCC in the format needed by hashcat?

thanks so much in advance already Smile
Why 10241? If you use 10241 it will not work. Both JtR and hashcat use the $DCC2$ format.
because the example you gave me was
and so i exchanged just user and hash and let the rest as it was.
what is the 10240 anyway?
even if i tried it like that
or also
it did not work

edit: now i see what you mean. i changed it back to 10240 but still same error