ssonsvr.exe
by Citrix
Remote Access
Summary
Citrix Single Sign-On server process
ssonsvr.exe is the 1399th most commonly executed Windows program in EchoTrail's dataset, observed 860 times across enterprise environments. It typically runs from C:\Program Files (x86)\Citrix\ICA Client and it is most often launched by ssoncom.exe.
1399th
most commonly executed Windows program
860
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Program Files (x86)\Citrix\ICA Client100%
Top Hashes (SHA256)
- 731dcaa227aa936456b1838669f3a7e420937e50921b220bb0e498e083c72b0035.47%
- aee702a60962a74283e7206124f2a458eba82d8c6fd84d93e9d90f3f533689a235.12%
- 06e3eac0d1337ad735f7efe14851c535f01d72fc903e123532aeb95e1927bc9e14.3%
- 23c795be506afdf125235cb57ed9f6a04bf164fe3de609b9bbbdedddbcc357bb5%
- 205f4204cf4225963eb7e85ab7d77bb2ee6fd8457162fd4d7051198d4d9e512d4.88%
- ad86822833a15833faa307c02978a26c2b92ecdef0d61d35f7eb1edfa24ad7573.02%
- e9a639ef963e3dbd85060d0175cddf2fba1f5e0bae6c4db9fe5b732a56b3fcfc0.93%
- 80a396a0ffde89bf27d8605d08edfc61117dcb8bd9791ff1a83f86303a3dfc3e0.7%
- 5939e540eb7f14e1f6976c8a6525f433fbf1e0ff054e19b7389348111a04d7830.35%
- 91ef20a372c733422d9e67cba58ab5a528f44c3cbdfbd5831309ef135447402a0.12%
Process Ancestry
Top Grandparents
- svchost.exe99.87%
- SophosFS.exe0.13%
Top Parents
- ssoncom.exe99.88%
Top Children
- wfcrun32.exe74.09%
- AuthManSvr.exe25.91%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about ssonsvr.exe
Rocky answers questions about ssonsvr.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.