18

Of course there’s no problem with software using parts of the operating system to do its work.

The “suspicious” aspect would come in if something were to write a copy of an outdated operating system tool into the TEMP folder and execute it from there. Malware more often does stuff like that.

Not to mention that redistributing parts of Windows that way would likely be illegal.

Given what others have written above, it’s possible that it was just a coincidence that Avast0815User happened to have an older copy of BCDEdit.exe in the TEMP folder. Perhaps Avast sets its current folder to TEMP when it runs. I’ve not observed any Windows update / installation process that left a copy of BCDEdit.exe in the TEMP folder, though.

-Noel