The new Licenses are already shown in the citrix.com portal. Source: 9 months ago

Since the DDC's are hosted in citrix.com, it sees it as a multi-domain setup. I have ran into this on multiple customers using a "single" domain. Source: about 1 year ago

Hey, I have gotten this alert on hosts for the past 4 months, have you found anything else. Looking at the logs, users enter through regular citrix.com but MDE flaggs this domain right after. Source: about 1 year ago

My personal analysis The domain app-workspace-citrix.com is hosted by ERANET INTERNATIONAL LIMITED (https://www.whois.com/whois/app-workspace-citrix.com), contact information is REDACTED for privacy. While the official domain of Citrix is hosted at CSC CORPORATE DOMAINS, INC (https://www.whois.com/whois/citrix.com), the information in the official domain is not redacted. The URLs on... Source: about 1 year ago

Decide till 5th march whether to extend your classic license one more time but only receive more info after march 8th? (watch citrix.com for exiting news ... Yeah sure). Source: over 1 year ago

Https://app.any.run/ should be enough for most of the cases. If you have packed/encrypted sample (like EMP.dll from Empress), you can't do anything. Source: about 1 year ago

If you open it on https://app.any.run it will show you the outbound connections it makes. If you're responsible for such things, you could then block this on your web proxy/firewall/whatever. Source: about 1 year ago

Hello! Try this https://app.any.run/. Source: over 1 year ago

Does anyone have an account at app.any.run to have more analysis about their file? Source: over 1 year ago

App.any.run was probably the most useful thing in getting to understand how malware works, its basically an sandbox where it shows you all actions, changes, modifications and network connections done by any executable, including any malware, you can begin by analyzing this piece of Redline Stealer. Source: over 1 year ago