Is xenon.exe part of the Xenon dashboard?

No. Xenon does not install a file called xenon.exe. It runs Xenon-Setup-x64.exe as an installer, xenon-native.exe as the dashboard window, xenon-helper.exe as the bridge to Windows audio, media and notifications, and node.exe as the local engine.

What is xenon-native.exe?

The dashboard window itself, a small native shell that draws the Xenon interface on the screen you picked. It is the process behind the system tray icon.

What is xenon-helper.exe?

The bridge to the parts of Windows a web app cannot reach: audio devices and per-app volume, media keys, notifications, the window list, global hotkeys, disk scanning and the Bluetooth phone link.

Why did Windows Defender flag it?

Since version 4.11.9 the installer, the app inside it and the helper are signed, so Windows shows a verified publisher. Microsoft grants reputation over time and Defender also judges what a program does, so a warning can still appear for a while. Every release also ships a signed SHA256SUMS file so you can verify the download yourself.

How do I remove Xenon completely?

Settings, then Apps, then Installed apps, then Xenon, then Uninstall. It removes both folders, the scheduled task and the tray app.

xenon.exe

Q: Where does Xenon install itself?

In two folders under your user profile: %LOCALAPPDATA%\Xenon and %LOCALAPPDATA%\Programs\Xenon. Nothing runs as a Windows service or as SYSTEM.

If you found an unfamiliar process on your PC and searched its name, the answer that is most often true comes first: it is probably not from Xenon.

Last updated: 26 September 2026

The short answer

Xenon does not install a file called xenon.exe. If Task Manager is showing you a process spelled exactly xenon.exe, it is almost certainly something else that happens to share the name, and the list below shows which of the two you are looking at.

If instead you are looking at xenon-native.exe or xenon-helper.exe, those are ours, and the rest of this page says exactly what each one does.

What Xenon does run on Windows

Four things of its own:

File	What it is
`Xenon-Setup-x64.exe`	The installer. You run it once; it does not stay on the system as a process.
`xenon-native.exe`	The dashboard window itself, a small native shell that draws the interface on the screen you chose. This is the one you see in the system tray.
`xenon-helper.exe`	The bridge to the parts of Windows a web app cannot reach on its own: audio devices and per-app volume, media keys, notifications, the window list, global hotkeys, disk scanning, and the Bluetooth phone link. It is started by the engine and answers it over standard input and output.
`node.exe`	The dashboard engine. Xenon is a local web app, so the thing serving it is plain Node.js listening on `127.0.0.1:3030`, an address only this PC can reach. If you turn on Phone access in Settings, it also listens on your local network, so the phones and tablets you pair can reach it.

They live in two folders under your user profile, never in Windows itself: %LOCALAPPDATA%\Xenon and %LOCALAPPDATA%\Programs\Xenon. A per-logon scheduled task starts the engine when you sign in, under your own account. If you accepted the administrator prompt at setup, that task runs elevated, which is what lets it read temperatures; nothing is installed as a Windows service.

Then there are the tools Xenon runs for specific features, each from its own developers rather than from this project, and each only when the feature that needs it is on:

LibreHardwareMonitor and PawnIO, installed through winget, read CPU and disk temperatures. PawnIO is a signed kernel driver, and the replacement for WinRing0, the driver behind most older hardware-monitoring false positives. Xenon has never shipped WinRing0 and never will.
PresentMon, Intel's frame-time tool, downloaded into Xenon's own folder, for the real in-game FPS counter.
FFmpeg for voice input and spoken replies, and Ollama only if you switch the assistant to the free local provider. The installer does not download either; you set them up from Settings when you want them.
Sunshine and Tailscale, only if you turn on remote PC control.

How to check what you actually have

In Task Manager, right-click the process and choose Open file location. If it is not under %LOCALAPPDATA%\Xenon or %LOCALAPPDATA%\Programs\Xenon, it is not this project.
Right-click the file, choose Properties and open the Digital Signatures tab. Since version 4.11.9, Xenon-Setup-x64.exe, xenon-native.exe and xenon-helper.exe are signed, and that tab shows the publisher. Files from older releases carry no signature, so for those the hash in the next step is the check.
Compare the file against what we published. Every release ships a SHA256SUMS file signed with the project's key, and this works the same for signed and older releases:
```
Get-FileHash .\Xenon-Setup-x64.exe -Algorithm SHA256
```
If the hash matches the line in that release's SHA256SUMS, the file is byte for byte the one GitHub Actions built from the published source code at that tag.
Upload the file to VirusTotal. A handful of engines flagging it while the rest come back clean usually points to a reputation problem, not to malware. If nearly every engine flags it, that is a different story.

If you never installed Xenon

Then whatever you are looking at is not from this project. Check the file location and the publisher as above. Nothing on this site will remove software we did not install, and no page here will ask you to download a "cleaner" to get rid of it: that is the usual shape of the scam that follows a search like this one.

If it is ours and Defender flagged it

That can still happen. Since version 4.11.9 the installer is signed, so Windows shows a verified publisher. SmartScreen may still warn for a while, because Microsoft grants reputation over time: click More info, then Run anyway. Defender also judges what a program does, not only who signed it, so a signed file can still be flagged.

The FAQ explains the two kinds of detection, which one the name of the warning tells you about, and how to add the exclusion if you want to keep using it. The short version: a name ending in !cl is the machine-learning verdict about reputation; a plain name is a behavioural signature reacting to an installer that carries a script that downloads code, which is also an accurate description of something you would not want. Neither is proof of anything on its own, which is why steps 2 and 3 above exist.

How to remove it completely

Settings → Apps → Installed apps → Xenon → Uninstall, or run UNINSTALL.bat from the folder you extracted if you installed the classic way. It removes both folders, the scheduled task and the tray app. The temperature components installed through winget are separate programs and are uninstalled separately, from the same Apps list.

If you were looking for Xenon the dashboard

It turns a spare monitor, a tablet, your phone or a CORSAIR Xeneon Edge into a touch control panel for your PC. It is free and needs no account. See what it does or read the FAQ.