From 430eb1df1aa9c68f4f163a7e81990c8914d5a8b8 Mon Sep 17 00:00:00 2001
From: Lucas Falslev <lfalslev@specterops.io>
Date: Thu, 12 Feb 2026 17:09:59 -0700
Subject: [PATCH 1/3] add compstatus handler to registryprocessors

---
 src/Runtime/ObjectProcessors.cs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/Runtime/ObjectProcessors.cs b/src/Runtime/ObjectProcessors.cs
index 16841a0..260669e 100644
--- a/src/Runtime/ObjectProcessors.cs
+++ b/src/Runtime/ObjectProcessors.cs
@@ -85,6 +85,9 @@ internal void ClearEventHandlers() {
             _spnProcessor.ComputerStatusEvent -= HandleCompStatusEvent;
             _ldapPropertyProcessor.ComputerStatusEvent -= HandleCompStatusEvent;
             _certAbuseProcessor.ComputerStatusEvent -= HandleCompStatusEvent;
+            foreach (var registryProcessor in _registryProcessorMap.Values) {
+                registryProcessor.ComputerStatusEvent -= HandleCompStatusEvent;
+            }
         }
 
         private async Task HandleCompStatusEvent(CSVComputerStatus status) {
@@ -376,6 +379,7 @@ await HandleCompStatusEvent(new CSVComputerStatus {
                     ret.NTLMRegistryData = await processor.ReadRegistrySettings(resolvedSearchResult.DisplayName);
                 } else {
                     var newProcessor = new RegistryProcessor(null, resolvedSearchResult.Domain);
+                    newProcessor.ComputerStatusEvent += HandleCompStatusEvent;
                     _registryProcessorMap.TryAdd(resolvedSearchResult.DomainSid, newProcessor);
                     ret.NTLMRegistryData = await newProcessor.ReadRegistrySettings(resolvedSearchResult.DisplayName);
                 }

From 2a441681bb9f2e44ac2f142fdb90f5b26c7bda20 Mon Sep 17 00:00:00 2001
From: Lucas Falslev <lfalslev@specterops.io>
Date: Thu, 19 Feb 2026 12:06:53 -0700
Subject: [PATCH 2/3] supply StrategyExecutor to RegistryProcessor

---
 Sharphound.csproj               | 3 +++
 src/Runtime/ObjectProcessors.cs | 3 ++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/Sharphound.csproj b/Sharphound.csproj
index 09e5cbb..dddc11e 100644
--- a/Sharphound.csproj
+++ b/Sharphound.csproj
@@ -36,6 +36,9 @@
 <!--       <Reference Include="SharpHoundCommon">-->
 <!--           <HintPath>..\SharpHoundCommon\src\CommonLib\bin\Debug\net472\SharpHoundCommonLib.dll</HintPath>-->
 <!--       </Reference>-->
+<!--        <Reference Include="SharpHoundRPC">-->
+<!--            <HintPath>..\SharpHoundCommon\src\SharpHoundRPC\bin\Debug\net472\SharpHoundRPC.dll</HintPath>-->
+<!--        </Reference>-->
         <Reference Include="System.DirectoryServices" />
         <Reference Include="System.DirectoryServices.Protocols" />
         <Reference Include="System.IO.Compression" />
diff --git a/src/Runtime/ObjectProcessors.cs b/src/Runtime/ObjectProcessors.cs
index 260669e..c80ed71 100644
--- a/src/Runtime/ObjectProcessors.cs
+++ b/src/Runtime/ObjectProcessors.cs
@@ -13,6 +13,7 @@
 using SharpHoundCommonLib.Enums;
 using SharpHoundCommonLib.OutputTypes;
 using SharpHoundCommonLib.Processors;
+using SharpHoundRPC.Registry;
 using SharpHoundRPC.Wrappers;
 using Container = SharpHoundCommonLib.OutputTypes.Container;
 using Group = SharpHoundCommonLib.OutputTypes.Group;
@@ -378,7 +379,7 @@ await HandleCompStatusEvent(new CSVComputerStatus {
                 if (_registryProcessorMap.TryGetValue(resolvedSearchResult.DomainSid, out var processor)) {
                     ret.NTLMRegistryData = await processor.ReadRegistrySettings(resolvedSearchResult.DisplayName);
                 } else {
-                    var newProcessor = new RegistryProcessor(null, resolvedSearchResult.Domain);
+                    var newProcessor = new RegistryProcessor(null, new StrategyExecutor(), resolvedSearchResult.Domain);
                     newProcessor.ComputerStatusEvent += HandleCompStatusEvent;
                     _registryProcessorMap.TryAdd(resolvedSearchResult.DomainSid, newProcessor);
                     ret.NTLMRegistryData = await newProcessor.ReadRegistrySettings(resolvedSearchResult.DisplayName);

From 80c17fb4b4dc47c3ae2eba87f6bca8cb1aff417b Mon Sep 17 00:00:00 2001
From: Lucas Falslev <lfalslev@specterops.io>
Date: Fri, 20 Feb 2026 16:34:11 -0700
Subject: [PATCH 3/3] use getOrAdd to fetch processors from
 ConcurrentDictionary

---
 src/Runtime/ObjectProcessors.cs | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/src/Runtime/ObjectProcessors.cs b/src/Runtime/ObjectProcessors.cs
index c80ed71..74d5810 100644
--- a/src/Runtime/ObjectProcessors.cs
+++ b/src/Runtime/ObjectProcessors.cs
@@ -376,14 +376,12 @@ await HandleCompStatusEvent(new CSVComputerStatus {
 
             if (_methods.HasFlag(CollectionMethod.NTLMRegistry)) {
                 await _context.DoDelay();
-                if (_registryProcessorMap.TryGetValue(resolvedSearchResult.DomainSid, out var processor)) {
-                    ret.NTLMRegistryData = await processor.ReadRegistrySettings(resolvedSearchResult.DisplayName);
-                } else {
+                var processor = _registryProcessorMap.GetOrAdd(resolvedSearchResult.DomainSid, _ => {
                     var newProcessor = new RegistryProcessor(null, new StrategyExecutor(), resolvedSearchResult.Domain);
                     newProcessor.ComputerStatusEvent += HandleCompStatusEvent;
-                    _registryProcessorMap.TryAdd(resolvedSearchResult.DomainSid, newProcessor);
-                    ret.NTLMRegistryData = await newProcessor.ReadRegistrySettings(resolvedSearchResult.DisplayName);
-                }
+                    return newProcessor;
+                });
+                ret.NTLMRegistryData = await processor.ReadRegistrySettings(resolvedSearchResult.DisplayName);
             }
 
             if (_methods.HasFlag(CollectionMethod.WebClientService)) {