see my reply #16
and the file name shown in VT scan (bot.exe) does not mean much … if i still had that sample i could have uploaded it again and called it Michael