Incident Response Web Server Logs: Ep.6 — The Tomcat's Out Of The Bag

i need help with these two please
What account did they log in to?

Which vulnerability scanner was used by the attacker?