Verify Your Download
Why this matters: comparing the installer's fingerprint (a SHA-256 hash) is how you confirm the file you received is byte-for-byte the file we published, and that nothing altered it on the way to you.
The installer is now code-signed, so Windows can also tell you who made it. Both checks are worth doing, and they answer different questions: the signature says who, the hash says exactly which file.
You do not have to type anything. The installer shows you its own fingerprint.
1. Run the installer
On the second screen, before anything is installed or changed, the installer displays its own SHA-256 fingerprint, computed from the file you are actually holding, at that moment.
Nothing has been written to your machine at that point. You can still cancel.
2. Compare it to the published fingerprint
The fingerprint is published on the download / receipt page you bought from. That page is the authoritative source.
Compare the two. Case does not matter; every character does.
If they match — your download is intact. Continue.
If they do not match — cancel, delete the file, and download it again. If a fresh download still does not match, stop and contact us (SUPPORT.md) before running it.
Checking it yourself instead
If you would rather not trust the installer to report on itself — a fair instinct — you can compute the hash independently in PowerShell:
Get-FileHash .\ChronoSophia2_Setup_<version>.exe -Algorithm SHA256
This is optional. It produces the same value the installer shows you.
What to expect when you run it
Windows will show a verified publisher. The certificate is issued to the individual behind NeuroCognica, so the User Account Control prompt shows a person's name rather than the brand. That is expected and correct.
If the publisher shows as Unknown, or there is no signature at all, do not run the file. That is the case the signature exists to catch. Check the hash and download again from your receipt page.
SmartScreen may say the file "isn't commonly downloaded." That is a statement about reputation, not about the signature. Reputation accrues to a publisher identity as installs accumulate, and this identity is new. Choose Keep and continue — after you have checked the fingerprint.
What we measured, on our own machines
We record what we measured rather than what we hope. All of it is on our hardware, not yours.
| Date | Build | Result |
|---|---|---|
| 2026-06-21 | unsigned 1.2.0 |
It was quarantined by Defender as Trojan:Win32/Bearfoos.B!ml |
| 2026-08-16 | unsigned 2.0.32 |
It was caught the same way, on the same machine, two months later |
| 2026-08-17 | unsigned 2.0.33 |
It was installed on a clean Windows 11 instance with no SmartScreen screen and no Defender warning |
| 2026-08-18 | unsigned 2.0.33 |
It was hard-blocked by Smart App Control. There was no "run anyway" — SAC does not offer one |
| 2026-08-22 | signed 2.0.36 |
It was admitted under Smart App Control enforced, and ran its wizard |
The !ml suffix means a machine-learning classifier decided a file looked
unusual, not that a known threat was found. Unsigned installers that extract and
run scripts are exactly its shape.
The 17th and the 18th are the pair worth understanding. The same unsigned build passed one day and was hard-blocked the next, because Smart App Control had moved from evaluation mode to enforcement on that machine. That is why the signature matters: it is the only thing that survives the switch.
If something does flag anyway
Check the fingerprint first. Then:
- Defender quarantine — restore from Windows Security ▸ Protection history.
- SmartScreen — More info → Run anyway.
- Smart App Control — there is no override. SAC offers "Okay" and "Get apps from the Store" and nothing else. If a signed build is ever blocked by SAC on your machine, do not fight it: email us (SUPPORT.md) and take the refund if you would rather not wait.
We are not asking you to take any of this on faith. That is exactly why the fingerprint check and the signature both exist.
About the signature
The installer, its uninstaller, and the programs inside it are signed through Azure Artifact Signing, with the private key held in a Microsoft FIPS 140-3 Level 3 HSM — there is no key file on our disk to steal.
Every signature is timestamped, which is what keeps it verifiable after the signing certificate itself expires.
You can check any of it yourself:
Get-AuthenticodeSignature .\ChronoSophia2_Setup_<version>.exe
Status should read Valid.
Our build records the real Authenticode result — read back from the finished file, never the mere intent to sign — into the release metadata, and the in-app updater refuses to apply an update on the stable and beta channels unless the staged installer verifies.
Verifying your artwork, separately
Different thing, worth knowing: every artifact ChronoSophia produces carries its own provenance chain, which you can verify independently of the download. See SECURITY_AND_PROVENANCE.md.