# anonymous-beta/sixerc architecture

> Architecture diagram of the GitHub repository anonymous-beta/sixerc, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/anonymous-beta/sixerc
- Repository: https://github.com/anonymous-beta/sixerc

## Overview

SIXERC presents itself as a Windows session-harvesting tool. The sampled code indicates credential collection, service access, and outbound transfer, alongside anti-analysis and cleanup behavior. The README offers no further capability details, and several module implementations were not sampled; this is therefore a high-level component inventory, not a complete call map.

Main entry points: [`src/main.cpp`](https://github.com/anonymous-beta/sixerc/blob/main/src/main.cpp) (Program Orchestration), [`src/modules/sic.cpp`](https://github.com/anonymous-beta/sixerc/blob/main/src/modules/sic.cpp) (M365 Service Access), [`src/modules/ep.cpp`](https://github.com/anonymous-beta/sixerc/blob/main/src/modules/ep.cpp) (Data Transfer), [`src/modules/ksd.cpp`](https://github.com/anonymous-beta/sixerc/blob/main/src/modules/ksd.cpp) (Self-Destruct Operations)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_collection["Collection"]
  node_orchestrator["Program Orchestration<br/>[main.cpp]"]
  node_browser["Browser Session Collection<br/>[bps.cpp]"]
  node_crypto["Cryptographic Operations<br/>[crypto.cpp]"]
  node_validation["Session Validation<br/>[tvre.cpp]"]
end

subgraph group_access["Service Access"]
  node_service_access["M365 Service Access<br/>[sic.cpp]"]
  node_m365(("Microsoft 365 Services"))
end

subgraph group_transfer["Outbound Transfer"]
  node_transfer["Data Transfer<br/>[ep.cpp]"]
  node_c2(("Configured Endpoints"))
end

subgraph group_evasion["Evasion and Cleanup"]
  node_anti["Anti-Analysis Checks<br/>[antidebug.cpp]"]
  node_obfuscation["Obfuscation Utilities<br/>[obfuscation.cpp]"]
  node_persistence["Persistence Operations<br/>[ph.cpp]"]
  node_cleanup["Self-Destruct Operations<br/>[ksd.cpp]"]
end

node_operator(("Local Execution"))

node_operator -->|"starts"| node_orchestrator
node_orchestrator -->|"checks environment"| node_anti
node_orchestrator -->|"requests collection"| node_browser
node_orchestrator -->|"requests validation"| node_validation
node_orchestrator -->|"requests enumeration"| node_service_access
node_service_access -->|"sends requests"| node_m365
node_orchestrator -->|"requests transfer"| node_transfer
node_transfer -->|"sends data"| node_c2
node_orchestrator -.->|"optional cleanup"| node_cleanup
node_cleanup -->|"removes persistence"| node_persistence

click node_orchestrator "https://github.com/anonymous-beta/sixerc/blob/main/src/main.cpp"
click node_browser "https://github.com/anonymous-beta/sixerc/blob/main/src/modules/bps.cpp"
click node_crypto "https://github.com/anonymous-beta/sixerc/blob/main/src/core/crypto.cpp"
click node_validation "https://github.com/anonymous-beta/sixerc/blob/main/src/modules/tvre.cpp"
click node_service_access "https://github.com/anonymous-beta/sixerc/blob/main/src/modules/sic.cpp"
click node_transfer "https://github.com/anonymous-beta/sixerc/blob/main/src/modules/ep.cpp"
click node_anti "https://github.com/anonymous-beta/sixerc/blob/main/src/anti/antidebug.cpp"
click node_obfuscation "https://github.com/anonymous-beta/sixerc/blob/main/src/core/obfuscation.cpp"
click node_persistence "https://github.com/anonymous-beta/sixerc/blob/main/src/modules/ph.cpp"
click node_cleanup "https://github.com/anonymous-beta/sixerc/blob/main/src/modules/ksd.cpp"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_orchestrator,node_browser,node_crypto,node_validation toneBlue
class node_service_access,node_m365 toneAmber
class node_transfer,node_c2 toneMint
class node_anti,node_obfuscation,node_persistence,node_cleanup toneRose
class node_operator toneIndigo
```

## Components

### Collection

- [Program Orchestration](https://github.com/anonymous-beta/sixerc/blob/main/src/main.cpp): `src/main.cpp`
- [Browser Session Collection](https://github.com/anonymous-beta/sixerc/blob/main/src/modules/bps.cpp): `src/modules/bps.cpp`
- [Cryptographic Operations](https://github.com/anonymous-beta/sixerc/blob/main/src/core/crypto.cpp): `src/core/crypto.cpp`
- [Session Validation](https://github.com/anonymous-beta/sixerc/blob/main/src/modules/tvre.cpp): `src/modules/tvre.cpp`

### Service Access

- [M365 Service Access](https://github.com/anonymous-beta/sixerc/blob/main/src/modules/sic.cpp): `src/modules/sic.cpp`
- **Microsoft 365 Services**

### Outbound Transfer

- [Data Transfer](https://github.com/anonymous-beta/sixerc/blob/main/src/modules/ep.cpp): `src/modules/ep.cpp`
- **Configured Endpoints**

### Evasion and Cleanup

- [Anti-Analysis Checks](https://github.com/anonymous-beta/sixerc/blob/main/src/anti/antidebug.cpp): `src/anti/antidebug.cpp`
- [Obfuscation Utilities](https://github.com/anonymous-beta/sixerc/blob/main/src/core/obfuscation.cpp): `src/core/obfuscation.cpp`
- [Persistence Operations](https://github.com/anonymous-beta/sixerc/blob/main/src/modules/ph.cpp): `src/modules/ph.cpp`
- [Self-Destruct Operations](https://github.com/anonymous-beta/sixerc/blob/main/src/modules/ksd.cpp): `src/modules/ksd.cpp`

### Other components

- **Local Execution**

## Connections

- Local Execution → Program Orchestration: starts
- Program Orchestration → Anti-Analysis Checks: checks environment
- Program Orchestration → Browser Session Collection: requests collection
- Program Orchestration → Session Validation: requests validation
- Program Orchestration → M365 Service Access: requests enumeration
- M365 Service Access → Microsoft 365 Services: sends requests
- Program Orchestration → Data Transfer: requests transfer
- Data Transfer → Configured Endpoints: sends data
- Program Orchestration → Self-Destruct Operations: optional cleanup
- Self-Destruct Operations → Persistence Operations: removes persistence