More On Foreign Hashes

Technical note showing that NTLM hashes are computed over UTF-16LE, so source encodings (UTF-8 vs CP1256) produce the same UTF-16LE bytes for an Arabic password; it observes that Hashcat’s NT hash mode (`-m 1000`) fails to crack this non-ASCII case while John the Ripper succeeds, and recommends using Hashcat’s raw MD4 mode (`-m 900`) with `--hex-charset` and masks targeting Arabic code points (0x0600-0x06FF) and Latin digits (0x0030-0x0039); includes example byte sequences, the cracked hash format, and notes on performance trade-offs.