diff --git a/North Koreans APT/Velvet Chollima/README.md b/North Koreans APT/Velvet Chollima/README.md
index f18b869..b22aa2b 100644
--- a/North Koreans APT/Velvet Chollima/README.md	
+++ b/North Koreans APT/Velvet Chollima/README.md	
@@ -20,4 +20,4 @@ https://www.bleepingcomputer.com/news/security/fake-google-meet-conference-error
 
 2. ClickFix technique: (Fake-Captcha) to make the target run PowerShell as an administrator and paste attacker-provided code.
 
-3. reverse shell: Make simple reverse shell payload to creates a TCP connection to a command and control (C2) server and listens for commands to execute on the target machine.
+3. reverse shell: Make simple reverse shell (payload.ps1) to creates a TCP connection to a command and control (C2) server and listens for commands to execute on the target machine.