DarkWatchman includes a feature complete C# keylogger that is dropped alongside the RAT in text format. The keylogger is provided as C# code and compiled during runtime from a Base64 PowerShell command stored in the registry. The keylogger code itself is obfuscated, with both function and variable names being randomized. However, there is no other obfuscation – no redundant logic or unnecessary functions – which leaves the entire compiled keylogger at 8.5kb