He downloaded it. Scanned it three times with different AV tools. Clean.
2:00:00. 2:00:10. 2:00:20.
But the third... the third was a direct FTP link buried in a Czech IT forum. It looked suspicious as hell: ftp.citrix.com/software/Receiver/Windows/Receiver%204.12/ . citrix receiver 4.12 download