Crypto Ransomware - How decryption is done when user accept to cooperate?

When you have been "hacked" and you accept to pay for decrypting your encrypted files, how the attacker do the job ?

I understood that a symmetric key is used, itself encrypted by the attacker public key.

• Is the symmetric key stored locally (victim computer) ?


• When the user "accepts" to cooperate, what are the technical details concerning decryption ?

Sometimes, the attacker decrypts some few files to prove he can decrypt all the files, but, if the victim has some crypto knowledge, how can the attacker just decrypt some files without revealing the symmectric key : is the decryption process done attacker-side ?

Thanks.