diff --git a/README.md b/README.md
index 3572518..1456f9a 100644
--- a/README.md
+++ b/README.md
@@ -15,6 +15,14 @@ Questions proven otherwise so I decided to release this unweaponized PoC to docu
 This PoC is a demonstration of rather simple technique, already known to the offensive community (so I'm not bringin anything new here really) in hope to disclose secrecy behind magic showed by commercial frameworks such as [MDSec's Nighthawk C2](https://www.mdsec.co.uk/nighthawk/) that demonstrate their evasion capabilities targeting both aforementioned memory scanners.
 
 
+Here's a comparison:
+
+1. Beacon not encrypted
+2. Beacon encrypted
+
+![comparison](images/comparison.png)
+
+
 ## How it works?
 
 This program performs self-injection shellcode (roughly via classic `VirtualAlloc` + `memcpy` + `CreateThread`). 
diff --git a/images/comparison.png b/images/comparison.png
new file mode 100644
index 0000000..c9fc543
Binary files /dev/null and b/images/comparison.png differ