The engine reads all readable memory segments committed by the target application, caching every address containing the user-specified value into a massive temporary table.
A: It's a heuristic detection for "potentially unsafe tools." Add an exception in your AV.