1) User must open the Microsoft Word email attachment 2) User must scroll to page three of the document, which will run the DealersChoice Flash object 3) The Flash object must contact an active C2 server to download an additional Flash object containing exploit code 4) The initial Flash object must contact the same C2 server to download a secondary payload 5) Victim host must have a vulnerable version of Flash installed