FIN7 Threat Hunting with Splunk: Ep.2 – Initial Access

Question 5 What are the last four characters of the SHA256 for 2-list.rtf?
Having issues finding this one, any hints?