Procmon shows the malicious module loaded using the regsvr32.exe process.   Phase two: Payload Analysis    The only module the XSL script loads is Irdsnhrxxxfery64, which is packed using the UPX packer