So I'm guessing they grabbed the %appdata% for Chrome and were able to get the passwords out of that?