The main loader and privilege escalation tool, “autorun.exe” fires up a special dropper, which is actually an Equation Group DoubleFantasy implant installer. The installer is stored as “show.dll” in the “Presentation” folder of the CDROM.