Get malware c2s from Cryptneturlcache

CryptnetUrlCache is a directory which contains cached certificate validation data - OCSP and CRLs for WinInet and WinHTTP library calls (most Windows native programs do it)
We can use the certificate serial number in OCSP requests and responses to retrieve the actual certificates from Certificate Transparency log database such as crt.sh. Subject Name and Subject Alternative Name will tell us what are the possible hostname values
This is useful when you want to examine where programs may have connected to …

blueteamsec can certificate certificates certificate transparency crt data database directory library log malware name ocsp requests transparency validation windows