From 9038da8e7981550fddfd63c33e72fcacddb70a4c Mon Sep 17 00:00:00 2001
From: S3N4T0R <121706460+S3N4T0R-0X0@users.noreply.github.com>
Date: Thu, 12 Sep 2024 08:42:07 -0400
Subject: [PATCH] Update README.md

---
 Chinese APT/Mustang Panda/README.md | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/Chinese APT/Mustang Panda/README.md b/Chinese APT/Mustang Panda/README.md
index aa62110..f1d0381 100644
--- a/Chinese APT/Mustang Panda/README.md	
+++ b/Chinese APT/Mustang Panda/README.md	
@@ -97,3 +97,14 @@ ToneShell Backdoor initializes data and dynamically allocates memory for a funct
   4.Debugging: Outputs static messages for diagnostics.
 
     manual compile: x86_64-w64-mingw32-gcc -o ToneShellBackdoor.exe ToneShellBackdoor.c -lwinhttp
+    
+
+## The third stage (execution technique)
+
+Validate and process data
+
+![Screenshot from 2024-09-12 08-23-09](https://github.com/user-attachments/assets/94004d84-3beb-4b9b-84f8-52562862de81)
+
+Now I will use the terminal and start the execut the payload after I uploaded it through another feature on the web page that controls the VScode.
+
+![Screenshot from 2024-09-12 08-32-33](https://github.com/user-attachments/assets/66eebaf2-2ff1-4aaa-afe3-af5654e9f5d6)