>>In the project all PRG files are in the folder \AppFolder\Programs Basically my project structures is as follows:

OK. VFP can cache fxp in the PROGWORK location though not usually inside an exe- but still worth checking for PROGWORK= or TMPFILES= in the project's or client's config.fpw.

For completeness, though I'm sure you would have said: not using Defox or other protection scheme?

How about Execscript() or Evaluate() or _execute() or _evaluate() or Compile or other use of interpreter that might involve a temporary fxp that goes out of scope?

I have seen password managers that build strings to be macro substituted or execscript()ed that was considered more secure than plain VFP code, not one of those?

Just in case I'd use gofish to do a search for dmitry in the project. Also for compile, execscript(), evaluate(), _exec, _eval ... Might be an "aha" moment to save you hours of fun...