diff --git a/Chinese APT/Wicked Panda/README.md b/Chinese APT/Wicked Panda/README.md
index 92eaaa4..4ee9279 100644
--- a/Chinese APT/Wicked Panda/README.md	
+++ b/Chinese APT/Wicked Panda/README.md	
@@ -96,3 +96,6 @@ Why the attackers Use Hashing?
 ## The third stage (MoonWalk backdoor)
 
 This payload is a malicious program that establishes a reverse shell to an attacker's machine, enabling them to remotely execute commands on the victim's system via cmd.exe. It communicates with the attacker's system using an unencrypted TCP connection. The shell receives commands, executes them, and sends the output back to the attacker. To ensure persistence, it modifies the Windows Registry under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, adding a key named MoonWalkBackdoor. This key points to a file path intended to make the payload launch automatically on user login. However, the path specified (C:\\Windows\\System32\\payload.dll).
+
+![Screenshot From 2024-12-29 07-24-47](https://github.com/user-attachments/assets/e4a1d6c4-923d-4a40-a179-e07e2a4fae9e)
+