This demo execute wannacry.bin(with md5 41b5ba4bf74e65845fa8c9861ca34508) and look for the killerswitch url