how are ntlm hashes pulled out of hives?