value:  DLL side-loading has been used to execute BBSRAT through a legitimate Citrix executable ssonsvr.exe. The Citrix executable was dropped along with BBSRAT by the dropper. 
name: Hijack Execution Flow: Dll Side