in cracks per example, sometimes there are some files named crack.exe , that fool users who think that file is the crack...so they click it and right after a firewall notice will ask if you wish to allow it to connect to the internet..
(personal experience

)