[Oni]

Hmmm I'd be careful with this:
https://www.hybrid-analysis.com/sample/e...6408666f45

Attempt to find devices in networks: "192.168.240.2/32, 192.168.241.102/32, 192.168.243.62/32, ..."

Doesn't look very good

From my understanding that functionality is typical of Adobe products, the modification would lie in amtlib.dll. This was released by PortableApps 10 years ago so any malicious functionality would likely be defunct. That said, anything posted here should be ran in a controlled environment with protections until you've made your own judgement.