Once executed, Maranhão Stealer lodges itself in a directory named “Microsoft Updater” under %localappdata%\Programs. The main element, updater.exe, is programmed to auto-launch via Run registry keys ...