ctfmon.exe

ctfmon.exe runs the Text Services Framework, which coordinates input method editors (IMEs), keyboard layouts, and alternative text input for applications. One instance runs per interactive user, started as part of bringing up the session, and runs as that user. The genuine binary lives at C:\Windows\System32\ctfmon.exe.

Legitimately, ctfmon.exe is present on every signed-in desktop, doing its work in the background. It supports input rather than launching programs, so it does not normally start other processes or reach the network.

ctfmon.exe is mostly a baseline process: its value is a steady identity, the logged-on user's account, a Microsoft signature, no children, and no network, so deviations are easy to see. The realistic abuse is impersonation (T1036.005), where malware borrows the obscure but familiar name from the wrong path or runs under the wrong account.

As a persistent per-user process it could also be an injection target (T1055). A ctfmon.exe that loads unusual modules, opens network connections, or spawns anything is acting outside its normal role.