xenon.exe: what it is, and how to check it yourself

Someone who finds an unfamiliar process on their PC deserves a straight answer rather than a sales page. This one starts with the answer that is most often true: it probably is not us.

Last updated: 13 September 2026

01The short answer

Xenon does not install a file called xenon.exe. Not the installer, not the app, not the background service. If Task Manager is showing you a process spelled exactly xenon.exe, it is almost certainly something else that happens to share the name, and the list below will tell you within a minute which of the two you are looking at.

If instead you are looking at xenon-native.exe or xenon-helper.exe, those are ours, and the rest of this page says exactly what each one does.

02What Xenon does run on Windows

Four things of its own:

They live in two folders under your user profile, never in Windows itself: %LOCALAPPDATA%\Xenon and %LOCALAPPDATA%\Programs\Xenon. A per-logon scheduled task starts the engine when you sign in, under your own account. If you accepted the administrator prompt at setup, that task runs elevated, which is what lets it read temperatures; nothing is installed as a Windows service.

Then there are the tools Xenon runs for specific features, each from its own developers rather than from this project, and each only when the feature that needs it is on:

• LibreHardwareMonitor and PawnIO, installed through winget, read CPU and disk temperatures. PawnIO is a signed kernel driver, and the replacement for WinRing0, the driver behind most older hardware-monitoring false positives. Xenon has never shipped WinRing0 and never will.
• PresentMon, Intel's frame-time tool, downloaded into Xenon's own folder, for the real in-game FPS counter.
• FFmpeg for voice input and spoken replies, and Ollama only if you switch the assistant to the free local provider. The installer does not download either; you set them up from Settings when you want them.
• Sunshine and Tailscale, only if you turn on remote PC control.

03How to check what you actually have

1. In Task Manager, right-click the process and choose Open file location. If it is not under %LOCALAPPDATA%\Xenon or %LOCALAPPDATA%\Programs\Xenon, it is not this project.
2. Compare the file against what we published. Every release ships a SHA256SUMS file signed with the project's key:

   Get-FileHash .\Xenon-Setup-x64.exe -Algorithm SHA256

   If the hash matches the line in that release's SHA256SUMS, the file is byte for byte the one GitHub Actions built from public source at that tag.
3. Paste the file into VirusTotal. A handful of engines flagging it while the rest come back clean is the signature of a reputation problem, not of malware. Everything flagging it is a different story.

04If you never installed Xenon

Then whatever you are looking at is not from here, and we would rather say so plainly than claim a process we did not start. Check the file location and the publisher as above. Nothing on this site will remove software we did not install, and no page here will ask you to download a "cleaner" to get rid of it: that is the usual shape of the scam that follows a search like this one.

05If it is ours and Defender flagged it

That happens, and the honest reason is that the installer is not code-signed yet. A certificate is a paid, identity-verified thing and this is a free one-person project; supporters are funding the first year. An unsigned installer that few people have downloaded starts from zero reputation, and every new release resets the counter.

The FAQ explains the two kinds of detection, which one the name of the warning tells you about, and how to add the exclusion if you want to keep using it. The short version: a name ending in !cl is the machine-learning verdict about reputation; a plain name is a behavioural signature reacting to an installer that carries a script that downloads code, which is also an accurate description of something you would not want. Neither is proof of anything on its own, which is why step 2 above exists.

06How to remove it completely

Settings → Apps → Installed apps → Xenon → Uninstall, or run UNINSTALL.bat from the folder you extracted if you installed the classic way. It removes both folders, the scheduled task and the tray app. The temperature components installed through winget are separate programs and are uninstalled separately, from the same Apps list.