Seems like the .scr files trigger CrowdStrike Falcon. Not clear where the executables run here come from...