diff --git a/README.md b/README.md
index efeaba9..d61a102 100644
--- a/README.md
+++ b/README.md
@@ -10,5 +10,8 @@ this is simple shellcode loader that utilize not well known WinAPI function whic
 
 4. It appears legitimate for GUI applications, as calling window procedures and processing messages is normal behavior, helping it blend in.
 
+credit : 
+
+https://isc.sans.edu/diary/32238
 
 <img width="1067" height="712" alt="Screenshot 2025-09-01 042556" src="https://github.com/user-attachments/assets/e52c1b05-a112-42fe-80d2-ff0bbdc7cd54" />