Ahriman uses WhiteFlute RPGMaker modules, which sometimes trigger AV heuristics because of encryption/code obfuscation. The culprit here (as is the case of all Ahriman games) is wfAudio.dll. The particular version he uses has some... odd behavior (wouldn't even start in my sandbox, despite not triggering my AV), so maybe it does some weird DLL hooking or injection for debugging/monitoring hotkey purposes. Should be completely innocuous, but I'm paranoid, so I just replaced it with a different wfAudio.dll from another game instead of running it out-of-sandbox.