> The suspicious events included strings commonly used by hackers (e.g. 414141…4141).

I had to look this up. "AAA…" (0x414141… in ASCII/UTF-8) is traditionally used as arbitrary user input that's easy to spot in places it shouldn't end up.

https://security.stackexchange.com/q/18680