Msconfig.exe -5 Executes command embeded in crafted c:\windows\system32\mscfgtlc.xml.
Resources:
Full path:
Notes: Thanks to Pierre-Alexandre Braeken - @pabraeken See the Payloads folder for an example mscfgtlc.xml file.