Downloaded from a cloned, fake website. Formatted hard drive, but pc still does weird stuff. Help please

This happend to a friend but because of me. I told him to download DBeaver since its a great free database manager tool. He googled it and clicked on the top result which was an ad. Everything happened fast, he downloaded a zip, double clicked the Setup inside it but Dbeaver was nowhere to be seen. I then noticed the url: dbeaven.digital, massive red flag, massive alert. Deleted the zip file, told friend not to enter any password, whatsoever. We didnt see anything unusual in the task manager, windows defender antivirus quick scan found nothing. Big scan would have took 17+ hours. Website was from Russia btw and the zip file was from a discord server(attachment link).

Friend decided to reinstall Windows. I told him he s gotta format the harddrive too to make sure. He said he did (im not 100%). Now, on the new windows, he has some weird chinese line typed into one of his README 😬

Please help asap. What could have happened?