Esentutl Steals Browser Information — Detection Rule

One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe

Read the full analysis on IntelFusions