Yea good thing you didn’t. MSHTA is the app that lets you run Microsoft HTML Apps (usually used for their help articles). Those can contain JavaScript or VBScript code. And since you’re pasting it in a Run box it’ll happily execute it, even if it’s a remote source.
Generally it would only run as your user (you’re not admin are you?), which would still be enough to make your life miserable, but it could also try to run known exploits and raise itself to admin and own your whole computer.
Yeah I love how people are panning it and laughing, but thin clients are bread and butter to most enterprises. I think we have around 1,800 deployed at last count. The price is competitive and if you’ve gone all in on the Microsoft ecosystem it makes sense.