NeuroCognica

Verify Your Download

Why this matters: this installer is not yet code-signed, so Windows cannot vouch for who made it. Comparing its fingerprint (a SHA-256 hash) is how you confirm the file you received is byte-for-byte the file we published, and that nothing altered it on the way to you.

You do not have to type anything. The installer shows you its own fingerprint.

1. Run the installer

On the second screen, before anything is installed or changed, the installer displays its own SHA-256 fingerprint, computed from the file you are actually holding, at that moment.

Nothing has been written to your machine at that point. You can still cancel.

2. Compare it to the published fingerprint

The fingerprint is published on the download / receipt page you bought from. That page is the authoritative source.

Compare the two. Case does not matter; every character does.

If they match — your download is intact. Continue.

If they do not match — cancel, delete the file, and download it again. If a fresh download still does not match, stop and contact us (SUPPORT.md) before running it.

Checking it yourself instead

If you would rather not trust the installer to report on itself — a fair instinct — you can compute the hash independently in PowerShell:

Get-FileHash .\ChronoSophia_Setup.exe -Algorithm SHA256

This is optional. It produces the same value the installer shows you.

What to expect when you run it

Because the installer is unsigned, Windows may push back. This is expected, and we would rather tell you now than have you discover it alone.

SmartScreen — "Windows protected your PC." SmartScreen warns about software it has not seen enough copies of yet; a new product from a small publisher always starts there. Click More info → Run anyway, once you have compared the fingerprint above.

Windows Defender — on one machine (2026-06-21) Defender quarantined an early unsigned build as Trojan:Win32/Bearfoos.B!ml. The !ml suffix means a machine-learning classifier flagged it, not that a known threat was identified. Later builds have installed on other machines with Defender fully active and no detection — but we will not tell you it cannot happen, because we have not proven that.

If it does happen: open Windows Security ▸ Protection history, find the item, and choose Restore. Do that only after the fingerprint matched.

We are not asking you to take any of this on faith. That is exactly why the fingerprint check exists, and why the quarantine is written down here instead of quietly left out.

When will it be signed?

Code signing requires purchasing a certificate, which has not yet been done. The pipeline is already built for it: installer/build.ps1 signs and then records the real Authenticode result — read back from the file, never mere intent — into the release metadata, and the in-app updater already refuses to apply unsigned updates on the stable and beta channels.

The moment a certificate exists, signed builds ship with no further work. Until then, builds are published honestly as unsigned_internal rather than described as something they are not.

Verifying your artwork, separately

Different thing, worth knowing: every artifact Chronos produces carries its own provenance chain, which you can verify independently of the download. See SECURITY_AND_PROVENANCE.md.