After downloading [event logs](https://metaproblems.com/aa50297520b4159c83a31f5fe8f9cdeb/bruteforce.evtx) I opened them with windows logs explorer. I sorted them by date and in the first one there was account name

**ericm**

Original writeup (https://github.com/mar232320/ctf-writeups/blob/main/metactf2021/ettuhacker.md).