报告口径本页直接渲染本地报告真源；静态能力、动态观察、推断和线上未验证项不得互相替代。
宽表格和代码可左右滑动查看。
AntiVirus Clean v1.0.0.7 产品功能与商业化分析#
精确包名：com.eduspot.antivirus.clean；样本及资料日期：2026-10-28，Asia/Shanghai（北京时间）。六专题补充版。
S1=当前APK静态直接证据；S2=工具回读；S3=当前真机观察；I=推断；U=未验证。反编译不是原始源码，内置配置不是线上最终配置。发布状态单独记录于批次入口。
结论与产品结构#
本包33个业务Activity均找到当前反编译文件，已按实际字符串建立功能索引：垃圾、媒体管理、应用卸载、病毒扫描、WhatsApp、相似图片、重复文件、图片/视频压缩、照片隐私、通知与权限管理、安全浏览器等。
ArthtablActivity的删除确认说明处理照片位置历史，原图仍可在相册查看；因此“Photo Privacy Clean”不能写成删除照片或加密相册。Overfuls/Narmpris是视频压缩与结果，Zonounc是图片压缩，Grapasset通过应用管理流程请求卸载。功能名与操作范围必须逐项区分。[N1]
主页Pourenc处理notify_action_id，并在onNewIntent重复分发；双击返回的时间门槛为2秒。普通启动与通知回流使用同一主页，但有不同上下文，不能把一次首启广告代表所有回流场景。[N2]
已确认入口与本次实际路径#
| 入口/功能 | 证据与限制 | 等级 |
|---|---|---|
| 静态工具族 | 通知登记覆盖垃圾、大文件、应用管理、病毒扫描、图片/视频/音频、照片压缩、重复图片、通知清理、权限管理、照片隐私、视频压缩、重复文件、WhatsApp清理、安全浏览器。实际页面与广告联调仍有缺口。 | S1 |
| 杀毒 | 集成Trustlook及相关页面/提示仅证明检测能力接入，未使用测试样本验证检出、误报或真实风险判定。 | S1/U |
| 真机 | 首启后GMA AdActivity及常驻服务已观察；未授予文件/使用情况/通知读取特殊权限，未执行删除。 | S3 |
广告请求、缓存、回调与来源的完整阅读顺序#
本次确认通知入口继续携带notify_action_id和notify_from_type，主页从onCreate初始化或onNewIntent进入分发。对应工具、权限和结果页必须在有相应上下文的路径上核验广告；没有从Ace复制恢复组件或广告规则。
首启GMA是本包S3事实，其他SDK仍按集成迹象。广告加载/展示的完整计数、线上槽位配置和所有回调尚未闭合，这部分保留明确缺口；已恢复的产品与通知主链可继续用于定向追查，不能用SDK数量代替商业化分析。
Google Mobile Ads、AppLovin、Pangle、Mintegral、Vungle、Bigo、Meta和Thinkup等代码/组件存在，首启GMA广告为S3。当前没有闭合每个工具入口的线上广告位/限额，不能据SDK数量认定当前平台出量，也不能给出伪造的每日次数。
静态SDK/适配器迹象：Google Mobile Ads、AppLovin、Pangle、Mintegral、Liftoff Vungle、Bigo、Meta Audience Network、AppsFlyer、Adjust、Firebase Messaging、Trustlook、AppMetrica。SDK目录存在不等于当前启用、出量或具有相应业务效果；本报告只把明确观察到的展示标S3。
广告场景台账#
本轮未形成完整、可验证的业务广告场景台账；SDK目录/广告位字段不能代替逐入口调用和线上配置。[U]
安装来源与下游差异#
DB9B.BDBD 接入Adjust的onAttributionChanged/onAttributionRead，并在Install Referrer成功后保存字符串、进入自有解析。解析facebook来源及utm_campaign/utm_content，Adjust的network/campaign非空也能改变来源状态；状态2为额外门禁。[A1][A2]
这证明具备来源差异处理，不证明当前测试安装落在哪一组，也不证明所有广告与通知都服从同一个来源状态。原始referrer、Token和广告标识没有进入文档。
产品页面与资源绑定#
以下按Manifest业务命名空间和页面直接引用的资源回查。标题/提示只证明页面实现与显示线索，不证明扫描、删除或安全检测有效；空标题也不意味着没有页面。
| 业务Activity | 直接资源/布局线索 | 代码与方法边界 |
|---|---|---|
subgrill.mecriou.statesolem.hooemen.sundishe.keysttrenc.TedionsatActivity |
AntiVirus Clean；Please find %s and enable the permission. | subgrill/mecriou/statesolem/hooemen/sundishe/keysttrenc/TedionsatActivity.java；57行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.isolaectu.ConcinvesActivity |
Application；Permission Manager；Special\npermissions；Sensitive\npermissions | subgrill/mecriou/statesolem/hooemen/sundishe/isolaectu/ConcinvesActivity.java；553行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.gensen.ZonouncActivity |
Delete；Compressing images...；Cancel；Picture Compressor；No images found；Compress | subgrill/mecriou/statesolem/hooemen/sundishe/gensen/ZonouncActivity.java；782行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.essrtif.IntrminatActivity |
Video Manager；Audio Manager；Picture Manager | subgrill/mecriou/statesolem/hooemen/sundishe/essrtif/IntrminatActivity.java；327行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.AppicaActivity |
本Activity未直接引用可读标题；需沿绑定/父类定位 | subgrill/mecriou/statesolem/hooemen/sundishe/AppicaActivity.java；134行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.defmidit.TranqcosyActivity |
WhatsApp Cleaner；Delete；No more junk；Cleaning up...；Cleaned up %1$s；Telegram Cleaner | subgrill/mecriou/statesolem/hooemen/sundishe/defmidit/TranqcosyActivity.java；940行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.absluenc.BoldstarkActivity |
Secure Browser | subgrill/mecriou/statesolem/hooemen/sundishe/absluenc/BoldstarkActivity.java；542行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.beltmis.DisbinActivity |
本Activity未直接引用可读标题；需沿绑定/父类定位 | subgrill/mecriou/statesolem/hooemen/sundishe/beltmis/DisbinActivity.java；9行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.comtabl.CaplinActivity |
The selected file <font color='red'> cannot be restored</font> after deletion. Do you want to continue?；Delete；Cleaning up...；Cancel；Cleaned up %1$s；Duplicate Cleaner | subgrill/mecriou/statesolem/hooemen/sundishe/comtabl/CaplinActivity.java；712行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.essrtif.UndemotActivity |
App Manager；Video Manager；Cleaning up...；Clean up %1$s；Notify Cleaner；Audio Manager | subgrill/mecriou/statesolem/hooemen/sundishe/essrtif/UndemotActivity.java；427行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.overwlai.TronalitActivity |
Notice；Settings；Notify Cleaner | subgrill/mecriou/statesolem/hooemen/sundishe/overwlai/TronalitActivity.java；163行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.hecttoc.GrapassetActivity |
App Manager；APP；Uninstall 1 App (%s)；Uninstall 1 App；Uninstall | subgrill/mecriou/statesolem/hooemen/sundishe/hecttoc/GrapassetActivity.java；1394行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.grineal.PourencActivity |
Press again to exit | subgrill/mecriou/statesolem/hooemen/sundishe/grineal/PourencActivity.java；231行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.overwlai.RecopoiActivity |
AntiVirus Clean；Garbage Cleanup Notification: Please find %s and enable it. | subgrill/mecriou/statesolem/hooemen/sundishe/overwlai/RecopoiActivity.java；59行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.beltmis.BegbarActivity |
本Activity未直接引用可读标题；需沿绑定/父类定位 | subgrill/mecriou/statesolem/hooemen/sundishe/beltmis/BegbarActivity.java；108行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.varyesso.UneaskwateActivity |
Scan Virus；%1$s issues found | subgrill/mecriou/statesolem/hooemen/sundishe/varyesso/UneaskwateActivity.java；326行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.decilut.CoarsthmActivity |
The selected file <font color='red'> cannot be restored</font> after deletion. Do you want to continue?；Select type；Delete；Cleaning up...；Clean up %1$s；Cancel | subgrill/mecriou/statesolem/hooemen/sundishe/decilut/CoarsthmActivity.java；786行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.beltmis.BounmmablActivity |
本Activity未直接引用可读标题；需沿绑定/父类定位 | subgrill/mecriou/statesolem/hooemen/sundishe/beltmis/BounmmablActivity.java；287行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.essrtif.UrbarreActivity |
Video Manager；Audio Manager；Picture Manager | subgrill/mecriou/statesolem/hooemen/sundishe/essrtif/UrbarreActivity.java；325行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.essrtif.GlosivActivity |
Delete %s videos(%s)；Delete %s pictures(%s)；Video Manager；Delete；Total %s videos；Total %s pictures | subgrill/mecriou/statesolem/hooemen/sundishe/essrtif/GlosivActivity.java；492行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.inforncer.OverfulsActivity |
Video Compressor | subgrill/mecriou/statesolem/hooemen/sundishe/inforncer/OverfulsActivity.java；429行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.overwlai.SmalossActivity |
Notify Cleaner | subgrill/mecriou/statesolem/hooemen/sundishe/overwlai/SmalossActivity.java；223行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.sustspoi.JudssioActivity |
OK；Language Selection | subgrill/mecriou/statesolem/hooemen/sundishe/sustspoi/JudssioActivity.java；386行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.varyesso.ProcentagActivity |
Virus scanning in progress,do you want to interrupt?；OK；Scan Virus；Stop scanning；No viruses detected.；Please check if the network connection is normal | subgrill/mecriou/statesolem/hooemen/sundishe/varyesso/ProcentagActivity.java；840行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.anectrenc.ArthtablActivity |
Delete confirmation；The location history of the photo will be deleted, and the original photo can still be viewed normally in the album.；Photo Privacy Clean；Photo information deleted successfully；Cancel；Privacy information is being cleared… | subgrill/mecriou/statesolem/hooemen/sundishe/anectrenc/ArthtablActivity.java；640行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.corrocope.OverecipActivity |
No viruses detected.；The photo privacy information has been deleted.；%s threats removed.；%s threats need attention.；Cleanup completed | subgrill/mecriou/statesolem/hooemen/sundishe/corrocope/OverecipActivity.java；568行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.inforncer.convplot.NarmprisActivity |
1 video saved；%1$s video is compressed；Compression failed；Video Slimming；1 video replaced | subgrill/mecriou/statesolem/hooemen/sundishe/inforncer/convplot/NarmprisActivity.java；555行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.diffebmi.DenomazActivity |
AntiVirus Clean；No more junk；Cleaning up...；Clean up %1$s；Junk Clean；Cleaned up %1$s | subgrill/mecriou/statesolem/hooemen/sundishe/diffebmi/DenomazActivity.java；797行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.inforncer.HeaoverActivity |
本Activity未直接引用可读标题；需沿绑定/父类定位 | subgrill/mecriou/statesolem/hooemen/sundishe/inforncer/HeaoverActivity.java；100行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.swearega.TrunrigiActivity |
Foreground service is enabled；Settings；Foreground service is disabled | subgrill/mecriou/statesolem/hooemen/sundishe/swearega/TrunrigiActivity.java；184行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.isolaectu.OffspherActivity |
%1$s Sensitive permissions；Permission Manager | subgrill/mecriou/statesolem/hooemen/sundishe/isolaectu/OffspherActivity.java；367行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.essrtif.HerdsmpanActivity |
Video Manager；Audio Manager；Picture Manager | subgrill/mecriou/statesolem/hooemen/sundishe/essrtif/HerdsmpanActivity.java；461行；工具报错标记0 |
subgrill.mecriou.statesolem.hooemen.sundishe.crasagi.DuswandeActivity |
Delete；Cleaning up...；Similar Pictures；Cleaned up %1$s；Delete %s photos(%s) | subgrill/mecriou/statesolem/hooemen/sundishe/crasagi/DuswandeActivity.java；725行；工具报错标记0 |
已解析的直接页面跳转#
逐条解析Intent及import后，仅保留目标确属本包业务Activity的调用。R8可能把点击回调合并到SDK命名空间，故源类位于SDK目录也不自动排除。动态路由、反射与Compose路由可能不在此表；不能把未命中当不可达。
| 发起类 | 目标页面 | 精确调用位置 |
|---|---|---|
BDB8B.DB99 |
subgrill.mecriou.statesolem.hooemen.sundishe.beltmis.BounmmablActivity |
BDB8B/DB99.java:28 |
subgrill.mecriou.statesolem.hooemen.sundishe.essrtif.GlosivActivity |
subgrill.mecriou.statesolem.hooemen.sundishe.essrtif.UndemotActivity |
subgrill/mecriou/statesolem/hooemen/sundishe/essrtif/GlosivActivity.java:424 |
subgrill.mecriou.statesolem.hooemen.sundishe.essrtif.IntrminatActivity |
subgrill.mecriou.statesolem.hooemen.sundishe.essrtif.GlosivActivity |
subgrill/mecriou/statesolem/hooemen/sundishe/essrtif/IntrminatActivity.java:312 |
subgrill.mecriou.statesolem.hooemen.sundishe.essrtif.HerdsmpanActivity |
subgrill.mecriou.statesolem.hooemen.sundishe.essrtif.GlosivActivity |
subgrill/mecriou/statesolem/hooemen/sundishe/essrtif/HerdsmpanActivity.java:261 |
subgrill.mecriou.statesolem.hooemen.sundishe.essrtif.UrbarreActivity |
subgrill.mecriou.statesolem.hooemen.sundishe.essrtif.GlosivActivity |
subgrill/mecriou/statesolem/hooemen/sundishe/essrtif/UrbarreActivity.java:144 |
subgrill.mecriou.statesolem.hooemen.sundishe.overwlai.SmalossActivity |
subgrill.mecriou.statesolem.hooemen.sundishe.overwlai.RecopoiActivity |
subgrill/mecriou/statesolem/hooemen/sundishe/overwlai/SmalossActivity.java:85 |
subgrill.mecriou.statesolem.hooemen.sundishe.overwlai.antorga.Breaksua |
subgrill.mecriou.statesolem.hooemen.sundishe.essrtif.UndemotActivity |
subgrill/mecriou/statesolem/hooemen/sundishe/overwlai/antorga/Breaksua.java:242 |
subgrill.mecriou.statesolem.hooemen.sundishe.varyesso.UneaskwateActivity |
subgrill.mecriou.statesolem.hooemen.sundishe.varyesso.ProcentagActivity |
subgrill/mecriou/statesolem/hooemen/sundishe/varyesso/UneaskwateActivity.java:191 |
subgrill.mecriou.statesolem.hooemen.sundishe.varyesso.UneaskwateActivity |
subgrill.mecriou.statesolem.hooemen.sundishe.varyesso.ProcentagActivity |
subgrill/mecriou/statesolem/hooemen/sundishe/varyesso/UneaskwateActivity.java:228 |
subgrill.mecriou.statesolem.hooemen.sundishe.varyesso.ProcentagActivity |
subgrill.mecriou.statesolem.hooemen.sundishe.varyesso.UneaskwateActivity |
subgrill/mecriou/statesolem/hooemen/sundishe/varyesso/ProcentagActivity.java:446 |
subgrill.mecriou.statesolem.hooemen.sundishe.beltmis.BegbarActivity |
subgrill.mecriou.statesolem.hooemen.sundishe.beltmis.BounmmablActivity |
subgrill/mecriou/statesolem/hooemen/sundishe/beltmis/BegbarActivity.java:64 |
subgrill.mecriou.statesolem.hooemen.sundishe.hecttoc.GrapassetActivity |
subgrill.mecriou.statesolem.hooemen.sundishe.essrtif.UndemotActivity |
subgrill/mecriou/statesolem/hooemen/sundishe/hecttoc/GrapassetActivity.java:361 |
subgrill.mecriou.statesolem.hooemen.sundishe.corrocope.OverecipActivity |
subgrill.mecriou.statesolem.hooemen.sundishe.corrocope.OverecipActivity |
subgrill/mecriou/statesolem/hooemen/sundishe/corrocope/OverecipActivity.java:177 |
subgrill.mecriou.statesolem.hooemen.sundishe.corrocope.OverecipActivity |
subgrill.mecriou.statesolem.hooemen.sundishe.varyesso.UneaskwateActivity |
subgrill/mecriou/statesolem/hooemen/sundishe/corrocope/OverecipActivity.java:221 |
BDB89.DB8D |
subgrill.mecriou.statesolem.hooemen.sundishe.keysttrenc.TedionsatActivity |
BDB89/DB8D.java:368 |
BDB89.DB98D |
subgrill.mecriou.statesolem.hooemen.sundishe.keysttrenc.TedionsatActivity |
BDB89/DB98D.java:280 |
D9DB9.DB99B |
subgrill.mecriou.statesolem.hooemen.sundishe.defmidit.TranqcosyActivity |
D9DB9/DB99B.java:112 |
D9DB9.DB99B |
subgrill.mecriou.statesolem.hooemen.sundishe.diffebmi.DenomazActivity |
D9DB9/DB99B.java:161 |
D9DB9.DB99B |
subgrill.mecriou.statesolem.hooemen.sundishe.diffebmi.DenomazActivity |
D9DB9/DB99B.java:163 |
远端覆盖、可用性与剩余验证#
通知配置通过业务接口/本地缓存读取，当前远端值未知。静态解码已经保留同源阅读副本与交叉验证；仍有b6/b7/b8等局部变量字节数组未直接解码，这些影响范围在方法级未完成项里保留，不把它们写成空配置或不存在。
当前尚未完整验证所有工具的权限通过/拒绝、扫描/结果、返回/退出和广告顺序。文件功能以测试副本验证删除或压缩结果；自然/渠道分组需脱敏实际状态或受控对照，不能只用安装器判断。
原有代码锚点 A#
| 编号 | 证明内容 | 本地源位置 | 核验 |
|---|---|---|---|
| A1 | Adjust回调 | jadx-repair/sources/DB9B/BDBD.java:308–331 |
已回读 |
| A2 | Referrer组合及分流 | jadx-repair/sources/DB9B/BDBD.java:517–553 |
已回读 |
| A3 | 常驻FGS19001及回退 | jadx-repair/sources/com/eduspot/clean/notify/service/NotificationService.java:137–180 |
已回读 |
| A4 | 普通通知轮询 | jadx-repair/sources/DB98/DB998.java:43–82 |
已回读 |
| A5 | 常驻构建 | jadx-repair/sources/DB98/DB98D.java:59–88 |
已回读 |
| A6 | 每类回退Pair | jadx-repair/sources/D8DD9/BDDD.java:25–43 |
已回读 |
| A7 | 随机/配额/间隔候选过滤 | jadx-repair/sources/DB98/BBB.java:412–510 |
已回读 |
| A8 | FCM入口与Token回调 | jadx-repair/sources/com/eduspot/clean/notify/service/MyFirebaseMessagingService.java:18–48 |
已回读 |
| A9 | 业务对象与ID绑定 | jadx-repair/sources/BBBB8/DB8D.java:597–618 |
已回读 |
| A10 | 普通通知候选注册 | jadx-repair/sources/BBBB8/DB8D.java:705–735 |
已回读 |
| A11 | 120与6默认参数读取 | jadx-repair/sources/DB98B/DB99.java:1525–1537 |
已回读 |
本轮补充代码锚点 N#
| 编号 | 证明内容 | 本地源位置 | 核验 |
|---|---|---|---|
| N1 | 照片隐私标题与位置历史删除确认 | jadx-repair/sources/subgrill/mecriou/statesolem/hooemen/sundishe/anectrenc/ArthtablActivity.java:384–412 |
已回读 |
| N2 | 主页处理actionId及初始化 | jadx-repair/sources/subgrill/mecriou/statesolem/hooemen/sundishe/grineal/PourencActivity.java:108–129 |
已回读 |
| N3 | 本地午夜与上一日时间 | jadx-repair/sources/DDDD/DB8D.java:12–35 |
已回读 |
| N4 | 每ID日期额度、时间与上次ID存储 | jadx-repair/sources/DB999/DB99.java:65–141 |
已回读 |
| N5 | 候选文案格式化和点击参数 | jadx-repair/sources/BBBB8/DB8D.java:637–676 |
已回读 |
| N6 | 两秒返回与onNewIntent通知重分发 | jadx-repair/sources/subgrill/mecriou/statesolem/hooemen/sundishe/grineal/PourencActivity.java:205–229 |
已回读 |
| N7 | B9单行四个通知对象与独立候选资源 | jadx-repair/sources/BBBB8/DB8D.java:693–702 |
已回读 |
| N8 | BD9单行九个通知对象与100060等候选池 | jadx-repair/sources/BBBB8/DB8D.java:805–806 |
已回读 |
| N9 | 点击类型改变PendingIntent请求码的辅助函数 | jadx-repair/sources/BBBB8/DB8D.java:870–872 |
已回读 |
六专题导航#
| 专题 | 用途 |
|---|---|
| 产品功能与商业化分析 | 业务任务、页面、广告与来源链 |
| 权限与后台机制拆包报告 | 声明、调用、实际授权和功能边界 |
| 保活与拉活反编译代码册 | 机制图、主链步骤、代码片段与控制流修复 |
| 拉活通知规则与文案全量报告 | 触发、状态、频控、动作、候选和多语言全文 |
| 样本与证据索引 | 版本、split、签名、定位与证据范围 |
| 真机动态验证与后台存活报告 | 真实操作、后台矩阵、观察与未执行项 |