The two variants of MPK share the same registry key that the Trojan uses to automatically run each time the system starts, specifically: [HKLM and HKCU]\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer Both MPK variants include key loggers that are extremely similar in functionality in addition to having the same strings used for headers within the key log file