if you look at the 5500 (netntlmv1) kernel you can see that it does involve DES encryption: https://github.com/hashcat/hashcat/blob/...5500_a0.cl
however, here is a post about recovering the ntlm hash from the netntlmv1 hash: https://hashcat.net/forum/thread-5912.html
however, here is a post about recovering the ntlm hash from the netntlmv1 hash: https://hashcat.net/forum/thread-5912.html