Why does Windows Defender delete xmrig.exe right after download?

Windows Defender usually removes xmrig.exe because it recognizes it as cryptocurrency-mining software, which attackers also use to mine on other people’s computers without permission. That warning does not automatically mean your download is infected, but you should check the file’s source and the detection details before you allow it to run.

Why the warning appears right after download

Microsoft Defender Antivirus, often called Windows Defender, checks files as they arrive on your computer. It can recognize a miner from its contents without waiting for you to open it.

XMRig is a legitimate, open-source mining program: its source code is available for inspection. It can mine Monero using your CPU, the main processor in your computer. But criminals also bundle it into malicious software or install it secretly. That unwanted use is called cryptojacking.

Because the same mining program can be used with or without your permission, Defender may flag even an authentic copy. Detection names vary, but some refer to coin mining or potentially unwanted software. Other warnings may indicate a separate threat, so the exact wording matters.

The disappearing file usually means Defender blocked or quarantined it. Quarantine means isolating a file so it cannot run; it is not always permanent deletion.

Check what actually removed it

Before downloading the file again, open Windows Security → Virus & threat protection → Protection history. Look for the event matching the download time.

Check:

• The affected file: Is it actually xmrig.exe, the downloaded archive, or another file?
• The detection name: Does it describe a miner, or something else?
• The action taken: Was the file blocked, quarantined, or removed?

A browser download warning is different from an antivirus action. If there is no matching entry in Protection history, your browser or another security product may have blocked it instead.

Avoid repeatedly restoring the file without understanding the warning. You could be bringing back a genuinely harmful download.

Check the download, not just the filename

A file named xmrig.exe is not necessarily the real XMRig. Anyone can give a harmful program that name.

If you intentionally downloaded XMRig:

• Get it from the official XMRig project or its official release repository, rather than an advertisement, chat attachment, or repackaged installer.
• Where available, compare its SHA-256 checksum with the project’s published value. This is a digital fingerprint that helps show whether your file matches the release.
• Treat instructions to disable all antivirus protection as a warning sign.

A matching checksum supports authenticity only if you trust the place publishing it. It does not prove that every file in a third-party mining package is safe.

If you never chose to install XMRig, leave it blocked and run a security scan.

If you decide to allow it

Only consider allowing a verified copy on a computer you own or are explicitly authorized to use for mining. On a work or school device, ask the administrator rather than bypassing security controls.

Keep Defender enabled. Any exception should be as narrow as possible; excluding your whole Downloads folder creates an unnecessary opening for unrelated malware. An exception reduces protection—it does not make a file safe.

The bottom line

Defender often removes XMRig because legitimate mining software is also widely abused. Check Protection history and verify the download before making an exception. If the source or warning remains unclear, leave it blocked.