/user <parameters>: Executes downloaded file with parameters specified using CreateProcessAsUser cmd /c <command>: Executes command on infected endpoint   Conclusion  The actor behind Honeybee has been operating with new implants since at least November 2017 with the first known version of NTWDBLIB installer