Nice memories

Note: The flag is the clear text password for river-security-xmas user.
On a IR mission we found that the threatactor dumped lsass file.
Can you rock our world and find the flag for us?