Darn looks like it definitely not 6 characters:
Session..........: hashcat
Status...........: Exhausted
Hash.Mode........: 500 (md5crypt, MD5 (Unix), Cisco-IOS $1$ (MD5))
Hash.Target......: $1$ucUReizE$7BNm6Kx48Jes8UPoQKnSj1
Time.Started.....: Mon Jan 02 13:18:45 2023 (1 hour, 43 mins)
Time.Estimated...: Mon Jan 02 15:01:47 2023 (0 secs)
Kernel.Feature...: Optimized Kernel
Guess.Mask.......: ?1?1?1?1?1?1 [6]
Guess.Charset....: -1 ?a, -2 Undefined, -3 Undefined, -4 Undefined
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 20528.4 kH/s (2.58ms) @ Accel:8 Loops:250 Thr:1024 Vec:1
Speed.#2.........: 24639.7 kH/s (9.96ms) @ Accel:512 Loops:62 Thr:128 Vec:1
Speed.#3.........: 15861.2 kH/s (7.47ms) @ Accel:32 Loops:250 Thr:512 Vec:1
Speed.#4.........: 16485.3 kH/s (0.86ms) @ Accel:256 Loops:62 Thr:256 Vec:1
Speed.#5.........: 14038.4 kH/s (3.54ms) @ Accel:64 Loops:250 Thr:256 Vec:1
Speed.#6.........: 10425.0 kH/s (7.02ms) @ Accel:32 Loops:250 Thr:512 Vec:1
Speed.#7.........: 7515.6 kH/s (1.89ms) @ Accel:128 Loops:125 Thr:256 Vec:1
Speed.#8.........: 7559.4 kH/s (1.91ms) @ Accel:128 Loops:125 Thr:256 Vec:1
Speed.#9.........: 75364 H/s (1.46ms) @ Accel:128 Loops:62 Thr:8 Vec:4
Speed.#*.........: 117.1 MH/s
Recovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new)
Progress.........: 735091890625/735091890625 (100.00%)
Rejected.........: 0/735091890625 (0.00%)
Restore.Point....: 7729905664/7737809375 (99.90%)
Restore.Sub.#1...: Salt:0 Amplifier:94-95 Iteration:750-1000
Restore.Sub.#2...: Salt:0 Amplifier:94-95 Iteration:992-1000
Restore.Sub.#3...: Salt:0 Amplifier:94-95 Iteration:750-1000
Restore.Sub.#4...: Salt:0 Amplifier:94-95 Iteration:992-1000
Restore.Sub.#5...: Salt:0 Amplifier:94-95 Iteration:750-1000
Restore.Sub.#6...: Salt:0 Amplifier:94-95 Iteration:750-1000
Restore.Sub.#7...: Salt:0 Amplifier:94-95 Iteration:875-1000
Restore.Sub.#8...: Salt:0 Amplifier:94-95 Iteration:875-1000
Restore.Sub.#9...: Salt:0 Amplifier:94-95 Iteration:992-1000
Candidate.Engine.: Device Generator
Candidates.#1....: ^O(}? -> ~}~}
Candidates.#2....: lEyZ| -> iw'<~
Candidates.#3....: J@=`} -> BAX}?
Candidates.#4....: H*Y|~ -> ~89}?
Candidates.#5....: .@%~} -> [S,~}
Candidates.#6....: DAX}? -> L;?'~
Candidates.#7....: AJP?} -> fRt ~
Candidates.#8....: U5q~} -> Sv*|~
Candidates.#9....: 4R(q} -> W.!{~
Hardware.Mon.#1..: Temp: 47c Fan:100% Util: 0% Core: 0MHz Mem: 405MHz Bus:1
Hardware.Mon.#2..: Temp: 54c Fan: 95% Util: 79% Core:1950MHz Mem:9251MHz Bus:1
Hardware.Mon.#3..: Temp: 49c Fan: 96% Util: 0% Core: 210MHz Mem: 405MHz Bus:1
Hardware.Mon.#4..: Temp: 49c Fan: 90% Util: 0% Core: 210MHz Mem: 405MHz Bus:1
Hardware.Mon.#5..: Temp: 44c Fan: 95% Util: 0% Core: 210MHz Mem: 405MHz Bus:1
Hardware.Mon.#6..: Temp: 49c Fan: 96% Util: 0% Core: 210MHz Mem: 405MHz Bus:1
Hardware.Mon.#7..: Temp: 50c Fan: 95% Util: 0% Core: 300MHz Mem: 405MHz Bus:1
Hardware.Mon.#8..: Temp: 45c Fan: 96% Util: 0% Core: 300MHz Mem: 405MHz Bus:1
Hardware.Mon.#9..: N/A
Started: Mon Jan 02 13:18:30 2023
Stopped: Mon Jan 02 15:01:49 2023
I'm gonna try 7. Are there any special characters I can omit. Seems like ?a option has a few that won't be used? (Otherwise it will take 7 days using my setup)