The xls attachment of the mail, also arrived in Italy, randomly contacts a link from an internal list and downloads the dll, starting the malware infection.
The email false xlsx points to a fake site with a zip document. This contains a VBS with a powershell which downloads the malware. C2 is the same as RemcosRAT.
Two different emails but with the same xls attachment, which contacts a random link from an internal list and downloads the dll, starting malware infection.