On July 1 version 4 of the GandCrab ransomware sees the light of day followed a few days later by version 4.0.1. These versions change the encryption method. The extension of the encrypted files is changed to .KRAB, and the instruction note file is named KRAB-DECRYPT.txt. The latter contains a public and private key. The encryption part is done by a separate process. Finally, once the encryption is finished, the ransomware closes and does not remain active in the system. This version no longer changes the victim's wallpaper.