This decrypted data is written to the following location:  %TEMP%\WUpdate.~tmp  This ‘WUpdate.~tmp’ file is then copied to a filename of ‘Applet.cpl’, which is placed in the previously identified file path