[itintheory]

Seems like the .scr files trigger CrowdStrike Falcon. Not clear where the executables run here come from...

[cluckindan]

Probably because .scr is not meant to be run directly, but malware regularly does that.