Hey, thanks a lot for taking the time to scan it - I really appreciate people being careful about what they run. Once you know what the app actually does, every line on that report has a pretty boring explanation. 🙂

The most important bit first: what you posted is a behavioural sandbox report (the "MITRE / Sigma / IDS / JA3 / dropped files" format), not an antivirus verdict. Those are heuristic observations of behaviour, not detections. The number that actually answers "is this malware?" is the AV detection score on VirusTotal's Detection tab - the "X / 70 engines flagged this" line. That's the one that matters, and I'd genuinely encourage you to check it; nothing in what you posted is an engine calling it malicious.

🗂️ "Dropped files: 108 + 1 PE DLL + 1 script + 1 text"
This is the scariest-looking item and it's 100% expected. The Connector is a self-contained single-file .NET app - the entire .NET runtime and its native libraries are bundled inside the one .exe so you don't have to install anything. The first time it runs, .NET unpacks those bundled libraries into a temp folder (%TEMP%\.net\…) and runs from there. That "unpack a pile of files on launch" step is exactly what the sandbox reports as 108 dropped files + a DLL. It's standard .NET single-file behaviour - nothing is written outside your own temp/install, nothing persists, nothing hides.
(Fun fact: this same self-extraction is why a handful of AV engines sometimes throw a generic false positive on single-file .NET builds - more on that below.)

🌐 Network: "18 DNS / 16 IP / 1 HTTP / 73 JA3"
It's a live VFR map + weather tool, so it contacts exactly the kinds of things a map app contacts - and nothing else:

Map tiles: OpenStreetMap, MapTiler, OpenTopoMap, Carto, tile.osm.ch, OpenAIP (aviation charts), OpenWeatherMap tiles
Weather / rain: open-meteo.com, RainViewer
Version check + anonymous usage stat: my little a5tr0.sk/…/ver2.php (ver.php in older version) (just "which version, roughly which country" - no accounts, no personal data)
Localhost: 127.0.0.1:9870 - the Connector's own local server that the in-sim panel / browser map talk to, entirely on your machine
The 16 IPs look like a lot, but map + weather tiles are served from CDNs that hand out many rotating IPs, so a handful of providers easily becomes 16 addresses. The 73 JA3 entries are just TLS fingerprints of all those HTTPS tile/weather requests - normal for anything pulling map data. No hardcoded C2, no odd ports, nothing outbound that isn't a map / weather / version endpoint.

🧩 MITRE (29 med / 26 low / 10 info), Sigma (2), IDS (2)
Generic "this program does networking, writes files, and reads some system info" heuristics. Any networked desktop app lights up dozens of them - note there's nothing High or Critical, it's all medium/low/info. The 2 Sigma / 2 IDS hits are the same flavour: "process made an outbound connection / dropped a file in temp."

On code signing: you're right that a proper signing certificate would make a lot of this look cleaner to sandboxes and AV. Honestly, this is a free hobby project and a cert just isn't something I can justify paying for right now - so I completely get it if the unsigned + self-extracting combo raises an eyebrow. It's a well-known rough edge of free .NET tools, not a sign of anything hidden.

If it helps, I'm more than happy to walk through any specific signature, hand over the complete list of endpoints it contacts, or answer anything else - I'd rather over-explain than leave anyone uneasy. Cheers, and thanks again for the diligence! ✈️

Hi Ddare. It appears you might be using the interface scaling buttons instead of the map zoom. Currently, the map itself can only be zoomed using the mouse scroll wheel. The upcoming update will introduce dedicated on-screen buttons specifically for map zooming. This will allow you to zoom the map independently without altering the text or interface size. I expect to release this update in a week or two. However, if I am misunderstanding your issue, could you please send me some screenshots via private message (showing the state before and after zooming)? Also, which text do you mean - the interface/addon text or the map text?

Hi Greg,

I'm sorry to hear you're experiencing this issue with the map being blocked. I tried to replicate the behavior you described, and I believe I know what's happening.

Currently, the consent/update window will keep appearing until you explicitly confirm or deny the update checks by clicking the "Continue" button. If you close the window by just clicking the "x" in the corner, your preference isn't saved. I completely understand how that can be annoying, so I will treat this as a feature request. I'll update the logic in the next version so that clicking the "x" automatically registers as a denial.

For now, please try making your selection (allow or deny) and then make sure to click the "Continue" button.

If the prompt still keeps coming back after doing that, please try using the "Factory Reset" option. Once the addon reloads, make your choice again and click "Continue" (again, please avoid just using the "x").
Important: Before doing a Factory Reset, please make sure to back up your API keys if you've entered any (under Menu > Configure API/User).

I've put together some screenshots showing exactly what to click here:
https://a5tr0.sk/fspm-osm/consent_and_reset/

Please let me know if using the "Continue" button helps resolve the issue for you! If not, please tell me exactly what steps you are taking, and I'll do my best to figure it out.

A5tr0