They ran Mimikatz, so they would have collected all the hashes for passwords, and then…you can crack them locally, you can run dictionaries against them and find those weak passwords that people use.