03-24-2024, 05:56 PM
This is likely a combination of factors that may not be so obvious. When hashcat starts up there is a list of optimizers that show what can be applied in the current attack. As you change things about the attack, some of those may become unavailable and the speed differences can be severe. For both MD5 and NTLM there is a major optimizer related to singal target attacks. Are you attacking multiple hashes? That will reduce the apparent speed significantly(sometimes as much as 60%) if so, though this isn't to say that attacking multiple hashes is bad or that the speed you are seeing is bad necessarily.