diff --git a/README.md b/README.md
index ea5105c..8164e98 100644
--- a/README.md
+++ b/README.md
@@ -117,7 +117,7 @@ However, no `Abnormal private executable memory` IOC this time. Our fluctuation
 
 And for the record, `pe-sieve` has no issues with our fluctuating shellcode as well:
 
-![pe-sieve](images/pe-sieve1.png)
+![pe-sieve](images/pe-sieve2.png)
 
 So we're able to see already that there are no clear references pointing back to our shellcode, at least memory IOC-wise. But what about that modified `kernel32` IOC?
 
diff --git a/images/pe-sieve2.png b/images/pe-sieve2.png
new file mode 100644
index 0000000..d4c55ba
Binary files /dev/null and b/images/pe-sieve2.png differ