diff --git a/Chinese APT/Wicked Panda/README.md b/Chinese APT/Wicked Panda/README.md
index 4ee9279..c46ea4a 100644
--- a/Chinese APT/Wicked Panda/README.md	
+++ b/Chinese APT/Wicked Panda/README.md	
@@ -99,3 +99,21 @@ This payload is a malicious program that establishes a reverse shell to an attac
 
 ![Screenshot From 2024-12-29 07-24-47](https://github.com/user-attachments/assets/e4a1d6c4-923d-4a40-a179-e07e2a4fae9e)
 
+1.Reverse Shell Creation:
+
+  Purpose: Establishes a reverse shell connection to a remote attacker's machine (IP,port).
+    Mechanism:
+        Connects to the attacker's system.
+        Opens a cmd.exe process on the victim's machine.
+        Sends commands received from the attacker to the shell and returns the output to the attacker.
+
+2. Persistence Mechanism:
+
+    Registry Manipulation:
+        Adds an entry in the Windows Registry under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.
+        This ensures the backdoor runs every time the user logs in.
+        The value points to C:\\Windows\\System32\\payload.dll (a likely misconfiguration, as the current code produces an executable, not a DLL).
+
+3. Networking:
+
+    Uses Windows' Winsock API to set up the socket connection to the attacker.