What is the difference between an NTLM hash and a Net-NTLM hash?
An NTLM hash is the user password hash stored locally in the Windows Security Account Manager (SAM) or in the NTDS.dit file on domain controllers, derived by MD4-encrypting the Unicode representation of the plaintext password. In contrast, a Net-NTLM hash is the hash that appears in network NTLM authentication as part of the challenge/response process—the client encrypts a server-issued challenge (a random 16-bit value) using its NTLM hash, and the resulting response contains the Net-NTLM hash. For more details, see Introduction to Windows Password Hashes - NTLM Hash and Net-NTLM Hash.
NTLM hashNet-NTLM hashchallenge/responseSAMNTDS.dit