Finding the culprit user for ransomware (15-03-18)

Right click properties of the recovery instructions see the owner of the file very likely this user has been compromised.