An email with the subject of BILL pretending to come from Store-Nellimarla Jute Mills Co Ltd. with a malicious word doc or Excel XLS spreadsheet attachment is another one from the current bot runs downloading Locky. The alleged senders email address ( the bit before the @ in < @slsenterprise.com > ) changes with each email received but the Store-Nellimarla Jute Mills Co Ltd and @slsenterprise.com stays consistent.