After downloading [event logs](https://metaproblems.com/aa50297520b4159c83a31f5fe8f9cdeb/bruteforce.evtx) I opened them with windows logs explorer. I sorted them by date and in the first one there was account name
**ericm**