Dropping payload via certutil

BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Excel file, they are prompted to enable a malicious macro that infects their device with BazaLoader. This query hunts for an attacker-created copy of certutil.exe, a legitimate process, which the macro uses to download BazaLoader.