strange file in public_html folder wordpress

well-known/pki-validation/ directories to show the certificate authority (CA) that they control the domain. … The CA will then scan for this code to validate the domain. The attackers use these locations to hide malware and phishing pages from the administrators

Your file is likely a ZIP file with something..
and xmlrpc.php file IN THIS folder is a malware (shell/backdoor)

you can delete this folder (.well-known/pki-validation/)
Also see https://ww.wp.xz.cn/support/article/faq-my-site-was-hacked/

and

Hardening WordPress

Its a malware, your site has been hacked and all files in that folder
.well-known/pki-validation/
are belonging to malware