09-02-2019, 12:08 AM
Update time!
Ok, so here is current performance against NTLM -
hashcat64.exe -m1000 -a3 d:\hashlists\Random\test.txt -O ?a?a?a?a?a?a?a?a -i -w2
I've found that for whatever reason, against NTLM and MD5 hashes I consistently get the best performance using -w2 and -O. If I use -w1, 3 or 4 the numbers are either a bit lower or a LOT lower. No idea why. I tested this against SHA2-256 and some other hashes (fast and slow) and found -w to work as intended, so -w 4 was always the fastest.
Things I also tried but seemed to make no difference - I set the pagefile larger, in increments of 10GB from 10GB to 100GB, no change. I put NVME drives in and tried those, both running hashcat off them and moving the pagefile to them from the SATA SSD, no change. The observed RAM and pagefile consumption by Windows did not change, and did not increase at all. I never observed more than 12GB consumption between RAM and pagefile utilization or commit, so I'm not thinking I'm hitting an issue with only 32GB of RAM but I'm certainly not ruling it out either. The hashcat64.exe process never directly consumed more than 1.9GB of memory that I observed, even after running it overnight against slow or fast hashes.
The only other thing I did was go into my BIOS and tinker with my CPU/PCI speed settings, but after making those changes no improvement to hashcat was observed. The speeds started going WAY up when I was changing to -w2 and using -O at the same time.
*shrug*
It's close enough to the benchmarks that I'm happy with the results, and now I'm working on improving my methodology using hashcat to crack hashes. I'd like to say thank you to y'all for putting up with me, I hope my posts in this thread help some poor soul in the future who runs into something strange like this.
Hashcat is an incredible tool, and getting better at it is something I have put off for too long. Time to dig in!
Ok, so here is current performance against NTLM -
hashcat64.exe -m1000 -a3 d:\hashlists\Random\test.txt -O ?a?a?a?a?a?a?a?a -i -w2
Quote:Session..........: hashcat
Status...........: Running
Hash.Type........: NTLM
Hash.Target......: (redacted)
Time.Started.....: Sun Sep 01 15:59:30 2019 (6 secs)
Time.Estimated...: Sun Sep 01 16:05:54 2019 (6 mins, 18 secs)
Guess.Mask.......: ?a?a?a?a?a?a?a [7]
Speed.#1.........: 67634.0 MH/s (4.98ms) @ Accel:64 Loops:512 Thr:256 Vec:2
Speed.#2.........: 53203.9 MH/s (7.62ms) @ Accel:128 Loops:512 Thr:256 Vec:2
Speed.#3.........: 31264.8 MH/s (7.21ms) @ Accel:256 Loops:256 Thr:256 Vec:2
Speed.#4.........: 29104.7 MH/s (5.63ms) @ Accel:128 Loops:256 Thr:256 Vec:2
Speed.#*.........: 181.2 GH/s
Hardware.Mon.#1..: Temp: 53c Fan: 98% Util: 92% Core:2085MHz Mem:7500MHz Bus:1
Hardware.Mon.#2..: Temp: 51c Fan: 48% Util: 95% Core:1923MHz Mem:5103MHz Bus:1
Hardware.Mon.#3..: Temp: 56c Util: 94% Core:2037MHz Mem:3802MHz Bus:1
Hardware.Mon.#4..: Temp: 56c Util: 93% Core:1429MHz Mem:3304MHz Bus:1
I've found that for whatever reason, against NTLM and MD5 hashes I consistently get the best performance using -w2 and -O. If I use -w1, 3 or 4 the numbers are either a bit lower or a LOT lower. No idea why. I tested this against SHA2-256 and some other hashes (fast and slow) and found -w to work as intended, so -w 4 was always the fastest.
Things I also tried but seemed to make no difference - I set the pagefile larger, in increments of 10GB from 10GB to 100GB, no change. I put NVME drives in and tried those, both running hashcat off them and moving the pagefile to them from the SATA SSD, no change. The observed RAM and pagefile consumption by Windows did not change, and did not increase at all. I never observed more than 12GB consumption between RAM and pagefile utilization or commit, so I'm not thinking I'm hitting an issue with only 32GB of RAM but I'm certainly not ruling it out either. The hashcat64.exe process never directly consumed more than 1.9GB of memory that I observed, even after running it overnight against slow or fast hashes.
The only other thing I did was go into my BIOS and tinker with my CPU/PCI speed settings, but after making those changes no improvement to hashcat was observed. The speeds started going WAY up when I was changing to -w2 and using -O at the same time.
*shrug*
It's close enough to the benchmarks that I'm happy with the results, and now I'm working on improving my methodology using hashcat to crack hashes. I'd like to say thank you to y'all for putting up with me, I hope my posts in this thread help some poor soul in the future who runs into something strange like this.
Hashcat is an incredible tool, and getting better at it is something I have put off for too long. Time to dig in!