Turla PNG Dropper is back

## Executive summary This blog post analyzes a Turla Group toolchain: a PNG Dropper that encodes PE files into PNG resources and an associated service component, RegRunnerSvc, which enumerates the registry to locate a 0x200-byte blob, uses CNG/BCrypt to derive an AES key from a system KSP key, decrypts an AES-encrypted PE and manually maps and executes it; the report includes Yara rules, two sample SHA256 hashes, the fake service name WerFaultSvc, and a link to a payload-extraction tool.