These are .exe files hosted on GitHub releases or external links. VirusTotal scans consistently show masquerading as keygens.