{
	"id": "b72ff695-722e-40ee-a8c8-2d7c31c52e9f",
	"created_at": "2026-04-06T00:22:03.202614Z",
	"updated_at": "2026-04-10T03:23:51.112884Z",
	"deleted_at": null,
	"sha1_hash": "212099000b5eb555971a7cfbe6f3b5b027ebd049",
	"title": "SendNotifyMessageA function (winuser.h) - Win32 apps",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 51339,
	"plain_text": "SendNotifyMessageA function (winuser.h) - Win32 apps\r\nBy jwmsft\r\nArchived: 2026-04-05 19:59:11 UTC\r\nSends the specified message to a window or windows. If the window was created by the calling thread,\r\nSendNotifyMessage calls the window procedure for the window and does not return until the window procedure\r\nhas processed the message. If the window was created by a different thread, SendNotifyMessage passes the\r\nmessage to the window procedure and returns immediately; it does not wait for the window procedure to finish\r\nprocessing the message.\r\nSyntax\r\nBOOL SendNotifyMessageA(\r\n [in] HWND hWnd,\r\n [in] UINT Msg,\r\n [in] WPARAM wParam,\r\n [in] LPARAM lParam\r\n);\r\nParameters\r\n[in] hWnd\r\nType: HWND\r\nA handle to the window whose window procedure will receive the message. If this parameter is\r\nHWND_BROADCAST ((HWND)0xffff), the message is sent to all top-level windows in the system, including\r\ndisabled or invisible unowned windows, overlapped windows, and pop-up windows; but the message is not sent to\r\nchild windows.\r\n[in] Msg\r\nType: UINT\r\nThe message to be sent.\r\nFor lists of the system-provided messages, see System-Defined Messages.\r\n[in] wParam\r\nType: WPARAM\r\nAdditional message-specific information.\r\nhttps://msdn.microsoft.com/library/windows/desktop/ms644953.aspx\r\nPage 1 of 3\n\n[in] lParam\r\nType: LPARAM\r\nAdditional message-specific information.\r\nReturn value\r\nType: BOOL\r\nIf the function succeeds, the return value is nonzero.\r\nIf the function fails, the return value is zero. To get extended error information, call GetLastError.\r\nIf you send a message in the range below WM_USER to the asynchronous message functions (PostMessage,\r\nSendNotifyMessage, and SendMessageCallback), its message parameters cannot include pointers. Otherwise, the\r\noperation will fail. The functions will return before the receiving thread has had a chance to process the message\r\nand the sender will free the memory before it is used.\r\nApplications that need to communicate using HWND_BROADCAST should use the RegisterWindowMessage\r\nfunction to obtain a unique message for inter-application communication.\r\nThe system only does marshalling for system messages (those in the range 0 to (WM_USER-1)). To send other\r\nmessages (those \u003e= WM_USER) to another process, you must do custom marshalling.\r\nNote\r\nThe winuser.h header defines SendNotifyMessage as an alias that automatically selects the ANSI or Unicode\r\nversion of this function based on the definition of the UNICODE preprocessor constant. Mixing usage of the\r\nencoding-neutral alias with code that is not encoding-neutral can lead to mismatches that result in compilation or\r\nruntime errors. For more information, see Conventions for Function Prototypes.\r\nRequirements\r\nRequirement Value\r\nMinimum supported\r\nclient\r\nWindows 2000 Professional [desktop apps only]\r\nMinimum supported\r\nserver\r\nWindows 2000 Server [desktop apps only]\r\nTarget Platform Windows\r\nHeader winuser.h (include Windows.h)\r\nLibrary User32.lib\r\nhttps://msdn.microsoft.com/library/windows/desktop/ms644953.aspx\r\nPage 2 of 3\n\nRequirement Value\r\nDLL User32.dll\r\nAPI set\r\next-ms-win-ntuser-message-l1-1-3 (introduced in Windows 10, version\r\n10.0.14393)\r\nSee also\r\nConceptual\r\nMessages and Message Queues\r\nPostMessage\r\nPostThreadMessage\r\nReference\r\nRegisterWindowMessage\r\nSendMessage\r\nSendMessageCallback\r\nSendNotifyMessage\r\nSource: https://msdn.microsoft.com/library/windows/desktop/ms644953.aspx\r\nhttps://msdn.microsoft.com/library/windows/desktop/ms644953.aspx\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://msdn.microsoft.com/library/windows/desktop/ms644953.aspx"
	],
	"report_names": [
		"ms644953.aspx"
	],
	"threat_actors": [
		{
			"id": "d90307b6-14a9-4d0b-9156-89e453d6eb13",
			"created_at": "2022-10-25T16:07:23.773944Z",
			"updated_at": "2026-04-10T02:00:04.746188Z",
			"deleted_at": null,
			"main_name": "Lead",
			"aliases": [
				"Casper",
				"TG-3279"
			],
			"source_name": "ETDA:Lead",
			"tools": [
				"Agentemis",
				"BleDoor",
				"Cobalt Strike",
				"CobaltStrike",
				"RbDoor",
				"RibDoor",
				"Winnti",
				"cobeacon"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434923,
	"ts_updated_at": 1775791431,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/212099000b5eb555971a7cfbe6f3b5b027ebd049.pdf",
		"text": "https://archive.orkl.eu/212099000b5eb555971a7cfbe6f3b5b027ebd049.txt",
		"img": "https://archive.orkl.eu/212099000b5eb555971a7cfbe6f3b5b027ebd049.jpg"
	}
}