Cyber security expert Michael Fratello has made a detailed analysis of the locker ransomware that implements a unique delivery mechanism. Locker affects all versions of Windows; this includes Windows XP, Windows 7, and Windows 8. The Trojan Downloader that delivers Locker is installed as a Windows service with a random file name. Another service was installed in the following directory: C:ProgramDataSteg with a file name of Tor. When executed, this service creates a folder named LDR.”]
Source: https://securityaffairs.co/wordpress/37325/malware/locker-ransomware-analysis.html