PoC: File/dir picker obscured by PiP

RCE: Opens calc.exe and cmd.exe with arbitrary arguments (e.g. ping example.com)

Seems like payload can be anything that would work in Win+R, so use your imagination (powershell, mshta, etc).