Normally I would get turned on by that, but I'm trying to be a nice person.

Holy crap, I had no idea! Cool!

The one positive is a malicious.high.ml.score by Trapmine and I can't makes heads or tails of it.

Domains  
e592.d.akamaiedge.net
www.msn.com
www.msn.com.edgekey.net

IP  
23.50.32.0/20 (owned by Akamai Technologies, Inc.)

Execution Parents  
Crack 29.2.ZIP

None of these sub categories under Relations give any positives.

You can also put it through sandboxes like joesandbox or cuckoo to try to trigger and detect a payload. But some malware will expect this and not execute.

Ultimately, judge your own risk tolerance by how much you trust the source, how much you want the software, what kind of systems protection you have in place (antivirus, antimalware, permissions control, backups), and how much you can afford to have your system compromised.

Thanks for the clarification on what the results on VirusTotal mean or how to interpret them!

Thank! VirusTotal does seem to have a lot more features than I initially thought/knew. :)

Thanks! By the way, have you done any time yet for RUI (rooting under the influence)?

https://en.wikipedia.org/wiki/Archicad

God this genuinely made me laugh. Thanks!

They're the ones in the secret cow level.

ArchiCAD uses a now-usual DRM scheme of either checking a hardware thumbstick key or seeking for a background licensing server at localhost or a set IP (always-on machine with a pool of licenses one can take one from).

https://help.graphisoft.com/AC/25/INT/_AC25_Help/003_InstallGuide/003_InstallGuide-4.htm (is it the version OP got?)

A cracker should either patch the requirement off completely (or drop exe, dlls for in-place replacement) or emulate a suitable key/server that is a separate app. With a lot of software I pirated with this DRM model it's usually the second way, emulating a server with always correct responses. If that's the case, the primary exe file can as well be original (of some distinct version?) but the crack happens to a separate background program installed with the main app.

I think we need another look at what is actually downloaded by OP and if there is some patching process jnvolved or everything is provided already cured. Then, to see and notice what processes are running in the VM, what they try to do.

If you have the executable from a trusted source, then you don't need to spend your time determining if a version you got from an unsafe location is legitimate, you'd just make a copy of the trusted original and throw out the bootleg to be safe.

In theory I agree, but other than buying the original executable from a reputable vendor, I have no way of verifying the integrity and authenticity of the EXE.