This is a Windows system installed file with Windows File Protection (WFP) enabled.
There are 50 versions of ctfmon.exe in the wild, the latest version being 6.2.9200.16384 (win8_rtm.120725-1247). ctfmon.exe is run as a standard windows process with the logged in user's account privileges. By adding a startup entry to the run registry key, the file will be executed when the user logs into Windows. The average file size is about 19.89 KB. During the process's lifecycle, the typical CPU resource utilization is less than 0.01%, the average private memory consumption is about 1.37 MB with the maximum memory reaching around 4 MB. Addionally, typically read and write I/O disk operations is about 170 Bytes per minute for reads and 0 Bytes per minute for writes.
CTF Loader, a Microsoft Windows process relating to the ctfmon.exe file, which monitors active windows and provides text support for speech and handwriting recognition, keyboard, translation, and other technologies.
(Note, the behaviors below are for all versions of ctfmon.exe, select a unique version for details.)
Runs under the registry key 'HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
Exceptions allow programs to access to the Internet through an outbound connections
Based on 40+ industry antivirus scanners, 14 of them detected the following malware.
United States installs about 35.90% of CTF Loader.
