W32/Wiper.C SHA1 – CB39C8639A2F74A3424D040D22A856859AB559A8 Similar to W32/Wiper.A, this version is also is being distributed by the people behind this threat. Depending on how it is distributed, the victim may launch different file names; the most common are diskpartmg16.exe and dpnsvr16.exe. For this example we will use “diskpartmg16.exe”. The “diskpartmg16.exe” version