After the payload is launched, the shellcode runs the following commands to prevent Microsoft Word from showing a recovery dialog:   Lastly, the shellcode overwrites the malicious file with a decoy document related to the Indian defense forces’ pay scale / matrix (Figure 3), displays it to the user and terminates the exploited instance of Microsoft Word