cloudyrobert
Tera Guru

Looked at this too. The payload shows that it used the correct VMWare credential, and the cred is pre-fixed with the domain.