# ajayrandhawa/keylogger architecture

> Architecture diagram of the GitHub repository ajayrandhawa/keylogger, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-10-01). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/ajayrandhawa/keylogger
- Repository: https://github.com/ajayrandhawa/keylogger

## Overview

This is a Windows keylogging and monitoring tool. Its documented workflow runs background processes that capture keystrokes, mouse activity, and screenshots, store activity in local files, then upload logs and images to an FTP server. The README also describes copying the executable into the user profile and configuring startup persistence. The repository contains one C++ source file, but its contents were not sampled; the graph therefore reflects README-documented capabilities and relationships only.

Main entry points: [`Sourcecode.cpp`](https://github.com/ajayrandhawa/keylogger/blob/master/Sourcecode.cpp) (Keylogger process)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_collection["Activity collection"]
  node_keylogger["Keylogger process<br/>[Sourcecode.cpp]"]
  node_input_capture["Input capture<br/>[Sourcecode.cpp]"]
  node_screenshot_process["Screenshot process<br/>[Sourcecode.cpp]"]
  node_screenshots["Screenshot capture<br/>[Sourcecode.cpp]"]
  node_local_logs["Local activity files<br/>[Sourcecode.cpp]"]
end

subgraph group_persistence["Startup persistence"]
  node_autocopy["Executable copy<br/>[Sourcecode.cpp]"]
  node_autostart["Startup configuration<br/>[Sourcecode.cpp]"]
end

subgraph group_transfer["Data transfer"]
  node_ftp_upload["FTP upload<br/>[Sourcecode.cpp]"]
  node_ftp_server["FTP server"]
end

node_operator(("Operator"))

node_operator -->|"runs"| node_keylogger
node_keylogger -->|"captures input"| node_input_capture
node_keylogger -->|"records activity"| node_local_logs
node_operator -->|"runs"| node_screenshot_process
node_screenshot_process -->|"captures desktop"| node_screenshots
node_screenshot_process -->|"uploads images"| node_ftp_upload
node_keylogger -->|"uploads logs"| node_ftp_upload
node_keylogger -->|"copies executable"| node_autocopy
node_keylogger -->|"configures startup"| node_autostart
node_ftp_upload -->|"sends files"| node_ftp_server

click node_keylogger "https://github.com/ajayrandhawa/keylogger/blob/master/Sourcecode.cpp"
click node_input_capture "https://github.com/ajayrandhawa/keylogger/blob/master/Sourcecode.cpp"
click node_screenshot_process "https://github.com/ajayrandhawa/keylogger/blob/master/Sourcecode.cpp"
click node_screenshots "https://github.com/ajayrandhawa/keylogger/blob/master/Sourcecode.cpp"
click node_local_logs "https://github.com/ajayrandhawa/keylogger/blob/master/Sourcecode.cpp"
click node_autocopy "https://github.com/ajayrandhawa/keylogger/blob/master/Sourcecode.cpp"
click node_autostart "https://github.com/ajayrandhawa/keylogger/blob/master/Sourcecode.cpp"
click node_ftp_upload "https://github.com/ajayrandhawa/keylogger/blob/master/Sourcecode.cpp"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_keylogger,node_input_capture,node_screenshot_process,node_screenshots,node_local_logs toneBlue
class node_autocopy,node_autostart toneAmber
class node_ftp_upload,node_ftp_server toneMint
class node_operator toneIndigo
```

## Components

### Activity collection

- [Keylogger process](https://github.com/ajayrandhawa/keylogger/blob/master/Sourcecode.cpp): `Sourcecode.cpp`
- [Input capture](https://github.com/ajayrandhawa/keylogger/blob/master/Sourcecode.cpp): `Sourcecode.cpp`
- [Screenshot process](https://github.com/ajayrandhawa/keylogger/blob/master/Sourcecode.cpp): `Sourcecode.cpp`
- [Screenshot capture](https://github.com/ajayrandhawa/keylogger/blob/master/Sourcecode.cpp): `Sourcecode.cpp`
- [Local activity files](https://github.com/ajayrandhawa/keylogger/blob/master/Sourcecode.cpp): `Sourcecode.cpp`

### Startup persistence

- [Executable copy](https://github.com/ajayrandhawa/keylogger/blob/master/Sourcecode.cpp): `Sourcecode.cpp`
- [Startup configuration](https://github.com/ajayrandhawa/keylogger/blob/master/Sourcecode.cpp): `Sourcecode.cpp`

### Data transfer

- [FTP upload](https://github.com/ajayrandhawa/keylogger/blob/master/Sourcecode.cpp): `Sourcecode.cpp`
- **FTP server**

### Other components

- **Operator**

## Connections

- Operator → Keylogger process: runs (evidence: `README.md`)
- Keylogger process → Input capture: captures input (evidence: `README.md`)
- Keylogger process → Local activity files: records activity (evidence: `README.md`)
- Operator → Screenshot process: runs (evidence: `README.md`)
- Screenshot process → Screenshot capture: captures desktop (evidence: `README.md`)
- Screenshot process → FTP upload: uploads images (evidence: `README.md`)
- Keylogger process → FTP upload: uploads logs (evidence: `README.md`)
- Keylogger process → Executable copy: copies executable (evidence: `README.md`)
- Keylogger process → Startup configuration: configures startup (evidence: `README.md`)
- FTP upload → FTP server: sends files (evidence: `README.md`)