He didn't open it. Instead, he dragged the zip file into his "Sandbox"—a virtual machine isolated from his actual computer. If this was a trap, he wanted it behind glass. Inside the zip was a single executable. He ran it.
Searching for or downloading "xworm56mainzip free" is highly dangerous. is a notorious Remote Access Trojan (RAT) xworm56mainzip free
: Capture passwords from web browsers and crypto wallets. He didn't open it
: This version introduced a "RemovePlugins" command, allowing the malware to wipe its own registry artifacts to avoid forensic detection. He didn't open it. Instead