This query detects literals that look like Solorigate Hash values used in the Solorigate code.

This query detects when the code includes at least 5 of the Hash literals used in the Solorigate tampered code

Please notice that by themselves these literals are not malign, but several of the values together would be less likely to be coincidental.