Add amindpdfcore.dll, msedgeupdate.dll, libcurl.dll (#78)

Signed-off-by: Still Hsu <[email protected]>
Co-authored-by: Wietze <[email protected]>

yml/3rd_party/amindpdf/amindpdfcore.yml

@@ -0,0 +1,26 @@
+---
+Name: amindpdfcore.dll
+Author: Still Hsu
+Created: 2024-05-26
+Vendor: AmindPDF
+ExpectedLocations:
+- '%PROGRAMFILES%\GeekerPDF\GeekerPDF'
+VulnerableExecutables:
+- Path: '%PROGRAMFILES%\GeekerPDF\GeekerPDF\GeekerPDF.exe'
+  Type: Sideloading
+  ExpectedVersionInformation:
+  - FileDescription: AmindPDF
+    InternalName: AmindPDF.exe
+    OriginalFilename: AmindPDF.exe
+    ProductName: AmindPDF
+  ExpectedSignatureInformation:
+  - Subject: CN=AmindPDF Limited, O=AmindPDF Limited, STREET="RM 802, 8/F IHOME CTR 369 LOCKHART RD", L=Wan Chai, S=Hong Kong Island, C=HK
+    Issuer: CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
+    Type: Authenticode
+  SHA256:
+  - 107ba73ae05ec6ba6d814665923191f14757015557eeeff16206cc957da29be3
+Resources:
+  - https://www.virustotal.com/gui/file/78a60bea5693138c771386b8c22f0adfe6765a6313b80488bd1084bc9ed370bd
+Acknowledgements:
+  - Name: Still Hsu
+    Twitter: '@AzakaSekai_'

yml/3rd_party/curl/libcurl.yml

@@ -0,0 +1,26 @@
+---
+Name: libcurl.dll
+Author: Still Hsu
+Created: 2024-05-26
+Vendor: curl
+ExpectedLocations:
+- '%PROGRAMFILES%\Notepad++\updater'
+VulnerableExecutables:
+- Path: '%PROGRAMFILES%\Notepad++\updater\GUP.exe'
+  Type: Sideloading
+  ExpectedVersionInformation:
+  - FileDescription: WinGup for Notepad++
+    InternalName: gup.exe
+    OriginalFilename: gup.exe
+    ProductName: WinGup for Notepad++
+  ExpectedSignatureInformation:
+  - Subject: CN="Notepad++", O="Notepad++", L=Saint Cloud, S=Ile-de-France, C=FR
+    Issuer: CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
+    Type: Authenticode
+  SHA256:
+  - e5bbbf34414426f63e6cd1354c306405e54bf31279829c7542dccfb7d85af0ec
+Resources:
+  - https://www.virustotal.com/gui/file/d1e44e4224899cb160a92f4c7f4f042b10ae0ee3fc16bbe457ad32e8b1527ed5
+Acknowledgements:
+  - Name: Still Hsu
+    Twitter: '@AzakaSekai_'

yml/microsoft/built-in/msedgeupdate.yml

@@ -0,0 +1,17 @@
+---
+Name: msedgeupdate.dll
+Author: Still Hsu
+Created: 2024-05-26
+Vendor: Microsoft
+ExpectedLocations:
+  - '%PROGRAMFILES%\Microsoft\EdgeUpdate\%VERSION%'
+VulnerableExecutables:
+  - Path: '%PROGRAMFILES%\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe'
+    Type: Sideloading
+    ExpectedSignatureInformation:
+    - Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
+      Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
+      Type: Authenticode
+Acknowledgements:
+  - Name: Still Hsu
+    Twitter: '@AzakaSekai_'