{ "schemaVersion": "deck-intelligence.v1", "id": "019dd923-622c-750b-8b96-2fbe642fbf78", "slug": "69cc18cfe079", "title": "NQ Mobile (NQ)", "subtitle": "Carson C. Block · 2013-10", "author": "Carson C. Block", "date": "2013-10-24 00:00:00", "pageCount": 81, "kind": "research-note", "orientation": "portrait", "aspectRatio": 0.77272725, "targetCompany": "NQ Mobile", "targetTicker": "NQ", "document": { "id": "019dd923-622c-750b-8b96-2fbe642fbf78", "slug": "69cc18cfe079", "title": "NQ Mobile (NQ)", "rawTitle": "MW NQ 10242013", "authorId": "51_Muddy_Waters", "authorName": "Carson C. Block", "authorDisplay": "Carson C. Block", "kind": { "slug": "research-note", "label": "Research note" }, "sourceType": { "slug": "short_seller", "label": "Short seller" }, "fileName": "2013-10-MW_NQ_10242013.pdf", "sourceUrl": "http://www.muddywatersresearch.com", "sourceDate": "2013-10-24 00:00:00", "presentationDate": "2013-10-24 00:00:00", "ingestedAt": "2026-04-22 19:11:44+00", "status": "ready", "pageCount": 81, "orientation": "portrait", "aspectRatio": 0.77272725, "targetCompany": "NQ Mobile", "targetTicker": "NQ", "metadata": { "local_root": "/tmp/legacy-images/69cc18cfe079", "activist_firm": "Muddy Waters", "origin_corpus": "contrarian", "extraction_seconds": 188.91913294792175 } }, "coverage": { "pageCount": 81, "pagesIndexed": 81, "pagesWithImages": 81, "pagesWithMetadata": 81, "imageCoveragePct": 100, "metadataCoveragePct": 100, "componentCount": 480, "chartCount": 7, "metricSlides": 0, "toolMatches": 7, "documentToolMatches": 4, "frameworkMatches": 34, "arcMatches": 1, "beatMatches": 3, "loopMatches": 0, "patternMatches": 0, "storymakersMatch": false, "scoreAvailable": false, "reviewAvailable": false, "activistThesisAvailable": true, "pitchdeckMetadataAvailable": false, "pitchdeckProfileAvailable": false }, "blocks": [], "matches": { "arcs": [ { "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null, "categoryName": "Booker's 7 Plots", "categorySlug": "booker-s-7-plots" }, "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "evidence": "The document follows a narrative of uncovering the truth about NQ Mobile's fraudulent activities, similar to overcoming a monster.", "isPrimary": true, "confidence": 0.8, "extraction": { "at": "2026-07-16 21:57:57.669858+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": "doc-narrative-v1" } } ], "beats": [ { "to": 15, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null, "categoryName": "Booker's 7 Plots", "categorySlug": "booker-s-7-plots" }, "from": 6, "name": "Expose Contradiction", "beatId": "950a2373-b77d-4c00-b8fc-2af98761fe7c", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document presents several contradictions in NQ Mobile's financials and business practices.", "position": 0, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 }, { "to": 5, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null, "categoryName": "Booker's 7 Plots", "categorySlug": "booker-s-7-plots" }, "from": 3, "name": "Villain Critique", "beatId": "a3eb7938-be35-4f27-9905-62d9f98704b3", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document critiques NQ Mobile's management and business practices.", "position": 1, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 }, { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null, "categoryName": "Booker's 7 Plots", "categorySlug": "booker-s-7-plots" }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "tools": [ { "tool": { "name": "CEO quote contradiction", "slug": "ceo-quote-contradiction", "status": "active", "bestFor": "When management credibility is the lever", "canonId": "019dd9e1-52e9-717f-8454-93e627563ed6", "version": 1, "bodyDocId": "019dd9a1-8296-720d-8f51-da76937f9415", "description": "You reproduce management's own words — verbatim, with source and date — and\nthen place them next to the outcome that contradicts them. The CEO built\nthe rope; you put it around their own neck.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "document", "agents": null, "matchId": "f711fb10-4950-4137-a212-c61110e8067a", "evidence": null, "pageRefs": null, "priority": null, "whenToUse": "When management credibility is the lever", "confidence": null, "extraction": { "at": "2026-04-29 12:07:50.005477+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": null, "whyItWorks": "- **Maximum credibility**: no adjective you could write is as damning as the\n target's own prior statement.\n- **No rebuttal path**: management can't argue they didn't say it.\n- **It forces accountability onto a person**, not an institution — even if\n you aren't explicitly naming a villain elsewhere.\n- **Reporters amplify it**. A CEO-quote-contradiction slide is quotable,\n which means it lands in WSJ/FT/Bloomberg coverage.", "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Peer gap chart", "slug": "peer-gap", "status": "active", "bestFor": "When relative underperformance is the core argument", "canonId": "019dd9e1-54f1-775a-94a1-d5cf3bb75abf", "version": 1, "bodyDocId": "019dd9a1-8653-7748-9050-807f067196c3", "description": "A single visual that benchmarks the target against its best-in-class peers on\na single quantitative KPI — and shows the target losing. The gap is the\npunchline.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "document", "agents": null, "matchId": "0c05bf43-0c67-4f99-9477-fe11c4f0a74b", "evidence": null, "pageRefs": null, "priority": null, "whenToUse": "When relative underperformance is the core argument", "confidence": null, "extraction": { "at": "2026-04-29 12:07:50.005477+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": null, "whyItWorks": "- It's the **most credible claim in the deck** because it's arithmetic, not\n opinion.\n- It's immediately **actionable** — close this gap and value accrues.\n- It **pre-empts the \"context is different\" defence** by pitting the target\n against direct peers in the same category.", "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Villain naming", "slug": "villain-naming", "status": "active", "bestFor": "When governance or specific decisions are the core thesis", "canonId": "019dd9e1-55a4-74db-9314-0ced4cd46cd2", "version": 1, "bodyDocId": "019dd9a1-88f1-72ad-8f4e-56ec29d7b369", "description": "You identify a **specific person** responsible for the target's underperformance\nor the behaviour you want changed — and name them. Not \"management\" or \"the\nboard\". A named executive or director with a specific failure attributable to\nthem.", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "document", "agents": null, "matchId": "c3bae122-8438-4cb6-910d-a1571a9d30df", "evidence": "Omar Khan (Co-CEO), Dr. Henry Yu Lin (Chairman/Co-CEO), and PwC (auditor)", "pageRefs": null, "priority": null, "whenToUse": "When governance or specific decisions are the core thesis", "confidence": null, "extraction": { "at": "2026-04-29 12:07:50.005477+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": null, "whyItWorks": "- **Accountability needs a face.** Voters (shareholders, regulators,\n journalists) act faster against people than institutions.\n- **Credibility rises with specificity.** \"The CFO has repeatedly missed\n guidance\" > \"Management has missed guidance\".\n- It **pre-empts evasion**. An individual can be removed; an abstraction\n cannot.\n- It **forces the target to respond personally** — and their defensive\n response usually generates more attention for your thesis.", "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Villain slide", "slug": "villain-slide", "status": "active", "bestFor": "In activist decks where the personality matters", "canonId": "019dd9e1-518c-7404-976a-5be5a517b659", "version": 1, "bodyDocId": null, "description": "A dedicated slide presenting the named villain visually", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "document", "agents": null, "matchId": "84d23608-8b56-491f-b534-2c2b35e4daa3", "evidence": null, "pageRefs": null, "priority": null, "whenToUse": "In activist decks where the personality matters", "confidence": null, "extraction": { "at": "2026-04-29 12:07:50.005477+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": null, "whyItWorks": "Makes the antagonist concrete", "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Villain slide", "slug": "villain-slide", "status": "active", "bestFor": "In activist decks where the personality matters", "canonId": "019dd9e1-518c-7404-976a-5be5a517b659", "version": 1, "bodyDocId": null, "description": "A dedicated slide presenting the named villain visually", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "648b112e-4a65-4bf4-ab09-c58f7611fd98", "evidence": "The slide presents a critical view of NQ's management, labeling them as 'sloppy' and 'comical' fraudsters, which aligns with the characteristics of a villain slide.", "pageRefs": null, "priority": null, "whenToUse": "In activist decks where the personality matters", "confidence": 0.9, "extraction": { "at": "2026-07-16 22:57:28.913642+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 4, "whyItWorks": "Makes the antagonist concrete", "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Villain slide", "slug": "villain-slide", "status": "active", "bestFor": "In activist decks where the personality matters", "canonId": "019dd9e1-518c-7404-976a-5be5a517b659", "version": 1, "bodyDocId": null, "description": "A dedicated slide presenting the named villain visually", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "41a236e8-8642-4467-818f-96a6eea98de1", "evidence": "The mobile security app market is much harder than NQ makes it appear (title matches villain_critique slide type)", "pageRefs": null, "priority": null, "whenToUse": "In activist decks where the personality matters", "confidence": 0.9, "extraction": { "at": "2026-07-16 22:57:39.248943+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 40, "whyItWorks": "Makes the antagonist concrete", "antipattern": null, "cardinality": null, "narrativePurpose": null }, { "tool": { "name": "Villain slide", "slug": "villain-slide", "status": "active", "bestFor": "In activist decks where the personality matters", "canonId": "019dd9e1-518c-7404-976a-5be5a517b659", "version": 1, "bodyDocId": null, "description": "A dedicated slide presenting the named villain visually", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "e1143ceb-1b5a-47ac-8222-3b28dd3c15f1", "evidence": "The Farcical Side (title matches villain_critique slide type)", "pageRefs": null, "priority": null, "whenToUse": "In activist decks where the personality matters", "confidence": 0.9, "extraction": { "at": "2026-07-16 22:57:39.331831+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 41, "whyItWorks": "Makes the antagonist concrete", "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [ { "matchId": "a5bf7a19-6693-42c4-a56e-5730553d8422", "evidence": "The slide systematically lists reasons why the company is a fraud (revenue, security, cash, acquisitions).", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:33.767+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 2, "frameworkName": "fraud-exposure" }, { "matchId": "ae099c11-b953-4074-b55c-c1c5e06b3d89", "evidence": "The document systematically dismantles the company's financial claims and product integrity.", "framework": null, "confidence": 1, "extraction": { "at": "2026-05-02 21:28:38.849+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 3, "frameworkName": "fraud-exposure" }, { "matchId": "5f258ce9-18c6-449e-8be4-18e2b2c29257", "evidence": "Systematic breakdown of management, auditor, and operational failures to prove fraud.", "framework": null, "confidence": 0.95, "extraction": { "at": "2026-05-02 20:51:32.33+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 4, "frameworkName": "fraud-exposure" }, { "matchId": "ed6042d1-acdd-40ca-b3da-66deeb73bfa0", "evidence": "The slide systematically deconstructs reported revenue figures against physical due diligence and financial analysis to prove fraud.", "framework": null, "confidence": 0.95, "extraction": { "at": "2026-05-02 20:51:32.228+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 6, "frameworkName": "fraud-exposure" }, { "matchId": "3a14565a-ebd5-40d1-9482-b8f1a7e57634", "evidence": "The slide systematically compares reported financial data against external claims to identify inconsistencies indicative of fraud.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:37.936+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 7, "frameworkName": "fraud-exposure" }, { "matchId": "2f4de96c-3245-453a-8f5d-df36494ec11b", "evidence": "Systematic debunking of corporate addresses to prove non-existence.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:35.636+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 11, "frameworkName": "fraud-exposure" }, { "matchId": "f3036a25-3dad-4867-9492-496c3fbba92c", "evidence": "The slide explicitly argues that YDT is a vehicle for defrauding investors through undisclosed related party transactions.", "framework": null, "confidence": 1, "extraction": { "at": "2026-05-02 20:51:32.562+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 14, "frameworkName": "fraud-exposure" }, { "matchId": "7fc4b008-9257-427f-8b13-d8205deb83ab", "evidence": "The slide systematically deconstructs NQ's claims against external verification (Alipay, Yeepay, Alexa data, market surveys).", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:33.685+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 18, "frameworkName": "fraud-exposure" }, { "matchId": "b78d2ae7-060a-4465-980b-c6fbf391cf87", "evidence": "The slide uses investigative findings to challenge the legitimacy of reported revenue streams.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:33.359+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 19, "frameworkName": "fraud-exposure" }, { "matchId": "45f45972-16b3-4cc6-8e70-66f2ec26f659", "evidence": "The slide uses physical evidence to expose a discrepancy between the company's claimed retail operations and the reality of its outdated, low-volume merchandise.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:34.535+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 22, "frameworkName": "fraud-exposure" }, { "matchId": "28553a64-2e6c-450a-8162-25f5b01ff3c9", "evidence": "The text explicitly anticipates and refutes two potential criticisms: sample size and geographic bias.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:34.778+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 25, "frameworkName": "preempt_rebuttal" }, { "matchId": "bf7f44af-f32c-4e62-aeb2-2ff86284fb3c", "evidence": "The authors describe their survey methodology as a test to validate their hypothesis of low market penetration.", "framework": null, "confidence": 0.8, "extraction": { "at": "2026-05-02 20:51:34.559+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 26, "frameworkName": "diagnostic-test" }, { "matchId": "fb745312-8cd2-4918-a6ee-0a6d245219ca", "evidence": "The slide systematically challenges the validity of market share claims through independent verification and logical deduction.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:35.471+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 29, "frameworkName": "fraud-exposure" }, { "matchId": "16bf1a13-a3d0-4628-8ca6-960ad42ddd52", "evidence": "The slide systematically links SAIC filing discrepancies to broader fraud indicators.", "framework": null, "confidence": 0.8, "extraction": { "at": "2026-05-02 20:51:37.013+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 32, "frameworkName": "fraud-exposure" }, { "matchId": "7726abd9-d411-4782-a30d-87f0bbf6125b", "evidence": "The slide explicitly accuses the company of fabricating revenue figures.", "framework": null, "confidence": 1, "extraction": { "at": "2026-05-02 20:51:36.881+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 37, "frameworkName": "fraud-exposure" }, { "matchId": "550b9806-6cc1-4e07-856f-9b51f21883db", "evidence": "The slide uses data and site visits to challenge the veracity of company claims.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:36.15+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 38, "frameworkName": "fraud-exposure" }, { "matchId": "c9ee2f2f-be4f-4eed-aca7-2263c5a5b66e", "evidence": "The slide systematically challenges company claims regarding revenue, DSOs, and acquisition costs.", "framework": null, "confidence": 0.85, "extraction": { "at": "2026-05-02 21:28:26.765+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 39, "frameworkName": "fraud-exposure" }, { "matchId": "da09f4a3-082a-4163-9580-048cb87b492d", "evidence": "The text explicitly questions the legitimacy of a financial transaction to suggest potential fraud.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:38.718+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 43, "frameworkName": "fraud-exposure" }, { "matchId": "a2d7d976-d1bb-4682-a205-17b738fb3210", "evidence": "The slide explicitly exposes deceptive 'scareware' practices by comparing UI claims to hardcoded source code.", "framework": null, "confidence": 0.95, "extraction": { "at": "2026-05-02 20:51:36.983+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 44, "frameworkName": "fraud-exposure" }, { "matchId": "4416af2b-9b7c-42f9-90d1-19ce5741a202", "evidence": "The slide systematically lists evidence of corporate deception and fraud to discredit management.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:44.06+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 46, "frameworkName": "fraud-exposure" }, { "matchId": "d43f4241-ab6e-4658-b2ae-833c405a2a5f", "evidence": "The text explicitly details the mechanics of 'China Fraud 1.0' vs '2.0' and the role of a front man.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:37.013+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 47, "frameworkName": "fraud-exposure" }, { "matchId": "964f5012-5f17-476b-9fa5-5eab4e5572f5", "evidence": "The slide explicitly details the mechanisms of financial fraud and identifies specific red flags in NQ's accounting.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:38.317+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 48, "frameworkName": "fraud-exposure" }, { "matchId": "3b6e62b3-232d-4e64-b754-571fd53b7384", "evidence": "The slide explicitly identifies 'warning signs' of fraudulent cash balances through accounting inconsistencies.", "framework": null, "confidence": 0.95, "extraction": { "at": "2026-05-02 20:51:38.288+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 49, "frameworkName": "fraud-exposure" }, { "matchId": "8d1f91d3-3560-4e95-855b-1b1ba19b0a89", "evidence": "The slide explicitly argues that the company's financial movements are implausible and indicative of fraud.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:37.699+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 50, "frameworkName": "fraud-exposure" }, { "matchId": "6e022f8a-2c36-4ae3-b82f-8e8b26ca2bfd", "evidence": "The slide explicitly argues that the company's financial narrative is inconsistent with regulatory reality to suggest fraud.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:38.796+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 51, "frameworkName": "fraud-exposure" }, { "matchId": "1b9637b1-69ec-47d5-ba19-43e0ddf08452", "evidence": "The slide explicitly argues that NQ uses acquisitions to commit fraud and divert IPO proceeds.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:38.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 53, "frameworkName": "fraud-exposure" }, { "matchId": "52f13cfe-f137-49dc-a754-1a5e5d833c2e", "evidence": "The slide systematically presents evidence of shell companies and fake shareholders to expose corporate fraud.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:37.707+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 54, "frameworkName": "fraud-exposure" }, { "matchId": "77f5748c-0143-4d2d-b9f6-1398d38a5817", "evidence": "The slide systematically lists acquisitions and business pivots as evidence of fraudulent activity.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:38.254+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 55, "frameworkName": "fraud-exposure" }, { "matchId": "45f1b7cc-5b99-4d8d-aaf0-7b085c59779a", "evidence": "The slide explicitly labels company assertions as 'fraudulent' and uses contradictory quotes to prove it.", "framework": null, "confidence": 1, "extraction": { "at": "2026-05-02 20:51:42.659+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 56, "frameworkName": "fraud-exposure" }, { "matchId": "a5ce5f16-46d1-4895-b84f-e9923d77fbd9", "evidence": "The slide explicitly lists 'tells' of sloppy audits as evidence of potential fraud.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:39.871+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 57, "frameworkName": "fraud-exposure" }, { "matchId": "41fee149-a519-41f5-b7b1-3cfeab729557", "evidence": "The slide explicitly identifies accounting manipulation (reclassification of costs) to mislead investors on gross margins.", "framework": null, "confidence": 0.95, "extraction": { "at": "2026-05-02 20:51:39.382+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 60, "frameworkName": "fraud-exposure" }, { "matchId": "9a7d351d-3af5-4b17-b1bf-128f65e16fde", "evidence": "The slide systematically identifies accounting errors to prove financial fraud.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:39.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 67, "frameworkName": "fraud-exposure" }, { "matchId": "c7172058-dacf-4147-8a4b-1eab557d3e43", "evidence": "The slide systematically compares public financial disclosures against regulatory requirements to suggest fraudulent activity.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-07-17 03:31:45.761+00", "model": "google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 68, "frameworkName": "fraud-exposure" }, { "matchId": "2aee1d4f-1467-434c-a255-cee7689345bf", "evidence": "The slide depicts a sequential user experience flow for an app update process.", "framework": null, "confidence": 0.8, "extraction": { "at": "2026-05-02 20:51:40.764+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 80, "frameworkName": "customer-journey-map" } ], "patterns": [] }, "storymakers": null, "score": null, "review": null, "activistThesis": { "tone": "adversarial", "notes": "Classic Muddy Waters short report formatted as a long-form research memo (Word-style, footnoted) rather than a slide deck — 81 pages of dense prose with embedded SAIC tables, pie-chart survey results (p27-28), VIE corporate-structure diagram (p50), and Android-malware screenshots in Appendix C. Carson Block frames the thesis as 'China Fraud 2.0,' an evolution of the China Fraud 1.0 playbook (smooth US CFO front) into a more substantive US-management veneer (Co-CEO Omar Khan). Strong CEO-quote-contradiction craft: Chairman Lin says ads are incompatible with security in Jan 2013, then celebrates ad revenue growth in Aug 2013; Khan's 'platform with 7-cent CAC' interview is dismantled in NQ's-Future section. Stake not disclosed as a percentage — boilerplate disclaimer notes Muddy Waters and affiliates hold a short position. Tone is openly mocking ('Family Guardian Emergency Response Vehicle,' 'NQ for Men,' 'transparency is the enemy of fraud'). The pie-charts on p27 are the closest thing to a peer-gap chart — NQ at 1% vs. Qihoo at 73% across all city tiers.", "kpisCited": [ { "detail": "≥72% of reported $32.2M (2012) is fictitious; real revenue $2.5M-$7.7M", "metric": "China security revenue fabrication rate" }, { "detail": "Survey shows 1.4% actual vs. ~55% claimed; Qihoo 360 holds 73.5%", "metric": "China mobile-security market share" }, { "detail": "<250,000 actual vs. 6,000,000 claimed", "metric": "Paying China users" }, { "detail": "$2.9M in 2012 vs. $20.2M NQ claims it generated from YDT", "metric": "Yidatong actual revenue (SAIC)" }, { "detail": "167 days at YE2012 vs. 30-day contractual settlement terms", "metric": "Days Sales Outstanding" }, { "detail": "$127.9M cash + term deposits classified as Level 2 assets by PwC — never seen before", "metric": "Cash balance classification" }, { "detail": "Only 4 of 113 phones in 5 Chinese cities had NQ pre-installed", "metric": "Retail bundling check" }, { "detail": "~$20M grant now worth ~$100M; never previously a C-level operator", "metric": "Omar Khan stock package" }, { "detail": "Purported $36.5M likely far less; one Android analytics firm estimates global app revenue well under $1.0M", "metric": "International revenue" } ], "closingAsk": "Sell NQ stock — Muddy Waters rates it a 'Strong Sell' with a target price below $1 and considers it a 'Zero.'", "extraction": { "at": "2026-04-22 19:11:44+00", "model": "unknown-legacy", "runId": null, "seconds": 188.91913, "promptVersion": null }, "scqaReward": "NQ should trade below $1, implying ~96% downside from the $22.88 reference price; Muddy Waters considers it a 'Zero' alongside prior China-fraud blowups like Longtop, Sino-Forest, and Ambow.", "thesisTypes": [ "fraud_exposure" ], "top3Reasons": [ "At least 72% of NQ's 2012 China security revenue is fictitious — largest 'customer' Yidatong is really NQ", "Real China mobile-security market share is ~1.4%, not the ~55% NQ claims (Qihoo 360 dominates at 73%)", "$127.9M reported cash is likely forged — PwC reclassified it as a Level 2 asset, IPO proceeds movement implausible under PRC FX controls" ], "scqaSituation": "NQ Mobile is a NYSE-listed Chinese mobile-security company claiming ~55% China market share, $32.2M in 2012 China security revenue, six million paying users, and $127.9M of cash from its 2011 IPO.", "thesisSummary": "Muddy Waters argues NQ Mobile is a wholesale fraud — 'China Fraud 2.0' — with at least 72% of its 2012 China security revenue ($32.2M) fictitious. NQ's largest purported customer, Yidatong (YDT), is really NQ itself: SAIC filings show YDT generated only $2.9M in 2012 vs. the $20.2M NQ claims, and visits to ten YDT addresses found ghost offices with zero employees. Surveys of 800+ smartphone owners across five Chinese cities show NQ's real mobile-security market share is 1.4%, not the ~55% it reports — Qihoo 360 dominates at ~73%. The $127.9M reported cash balance, oddly reclassified by PwC as a Level 2 asset, is likely forged given PRC capital controls that should have prevented the purported $47M IPO transfer to the VIE. With US Co-CEO Omar Khan acting as front, AV 7.0 itself is unsafe spyware. Target: under $1.", "primaryDemands": [ "Sell/short NQ stock — Muddy Waters rates it a 'Strong Sell' with target price under $1", "SEC and auditor (PwC) should investigate NQ's fabricated China revenue, related-party transactions through Yidatong, and Level 2 cash classification", "Investors and consumers should stop using NQ Antivirus 7.0, which Muddy Waters' security engineers found to be unsafe spyware vulnerable to MITM attack" ], "scqaResolution": "Short NQ stock; Muddy Waters has provided evidence — SAIC files, survey data, retail-channel checks, and security-engineer analysis of malware-laced AV 7.0 — to the SEC, and urges PwC to revisit its sloppy audits.", "thesisOneLiner": "NQ Mobile is a 'China Fraud 2.0': 72%+ of China revenue is fictitious, real market share is 1.4% not 55%, and the $127.9M cash balance is likely forged — target price under $1.", "precedentsCited": [ "Longtop Financial Technologies (LFT) fraud", "Sino-Forest VIE/cash fraud", "China Fraud 1.0 (smooth US-based CFO playbook)", "CCTV 3-15 Gala exposé of NQ malware (2012)", "Citron Research / Bronte Capital exposing Longtop", "Ambow, CILE, BORN, DYP, DGW, UTA — prior NYSE-listed China frauds" ], "scqaComplication": "At least 72% of that China revenue is fictitious — largest 'customer' Yidatong is a shell NQ secretly controls, ten YDT offices are ghost addresses, SAIC filings show only $2.9M of actual YDT revenue, and surveys put real market share at 1.4%.", "narrativeInterest": 4, "notableSlidePages": [ 2, 8, 27, 49, 50 ], "peerCompaniesCited": [ "Qihoo 360 Technology (QIHU)", "Tencent Holdings (HK: 700)", "Kingsoft Corp (HK: 3888)", "Longtop Financial Technologies", "Sino-Forest", "Ambow Education", "China Intelligent Lighting (CILE)", "China New Borun (BORN)", "Duoyuan Printing (DYP)", "Duoyuan Global Water (DGW)", "Universal Travel Group (UTA)" ], "valuationFrameworks": [ "other" ], "visualCraftInterest": 2 }, "pitchdeck": { "metadata": null, "profile": null }, "slides": [ { "page": 1, "type": "setup", "title": "Page 1 of 81", "function": "front_matter", "imagePath": "https://imgproxy.kitesheet.com/pqQdUgCOlTMtYYMk8p01w-HB5K08zyLS8Mk-8wRDs5M/rs:fit:1200:1200:0/q:82/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy82OWNjMThjZmUwNzkvcDAwMS5qcGc", "rawType": "disclaimer", "block": null, "metadata": { "slideType": "disclaimer", "slideTypeCanon": { "name": "Disclaimer", "slug": "disclaimer", "status": "active", "canonId": "019de52d-0801-727b-b98a-5ed095aeee78", "version": 1, "description": null }, "function": "front_matter", "functionCanon": { "name": "Front matter", "slug": "front_matter", "status": "active", "canonId": "019de52d-133d-73f0-9e26-201eda96b098", "version": 1, "description": null }, "density": "sparse", "densityScore": 4, "componentCount": 2, "textChars": 106, "nDataPoints": 0, "notes": "Page 1 of 81", "elementsJson": [ "paragraph", "logo_grid" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:30.689+00", "seconds": 2.264, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/1", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-1", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": { "h": 0.7, "w": 0.76, "x": 0.12, "y": 0.23 }, "kind": "disclaimer", "text": "Use of Muddy Waters reports is limited by the Terms of Service on its website...", "attrs": null, "canon": { "kind": { "name": "Disclaimer", "slug": "disclaimer", "status": "active", "canonId": "91173477-d91f-4024-bbaf-d4f93e3f82dc", "version": 1, "description": "Legal/cautionary text that occupies most of the body of its slide." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:30.689+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "35149f90-b60b-4dd8-9204-551af3828d6f", "parentComponentId": null }, { "bbox": { "h": 0.18, "w": 0.26, "x": 0.12, "y": 0.11 }, "kind": "image", "text": "Muddy Waters Research logo", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Logo", "slug": "logo", "status": "active", "canonId": "019de52c-fdaf-743d-94c4-d7c6a0e55302", "version": 1, "description": null }, "framework": null }, "subkind": "logo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:30.689+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3108b97a-5a6e-45ec-9026-4c7d727d48d5", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "thumbSrc": "https://imgproxy.kitesheet.com/hrrmvLzw1jD4RzI7MZEhYRiWEF5qKT5-68j2njf8vNY/rs:fit:480:480:0/q:78/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy82OWNjMThjZmUwNzkvcDAwMS5qcGc", "imagePathAlt": "https://imgproxy.kitesheet.com/8w05MLtebr5YeAy18L-hk8D4LyfE2mhdTzrAZ5mSPa0/rs:fit:1200:1200:0/q:82/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy82OWNjMThjZmUwNzkvcDAwMS5wbmc", "thumbSrcAlt": "https://imgproxy.kitesheet.com/B53L7yTRYUvQMK8A_JSPrFQb8dxIM3TfGP0G-OJst0Q/rs:fit:480:480:0/q:78/f:webp/czM6Ly9raXRlc2hlZXQvY29ycHVzL3NsaWRlcy82OWNjMThjZmUwNzkvcDAwMS5wbmc" }, { "page": 2, "type": "tension", "title": "This is a classic short-seller research note (Muddy Waters style).", "function": "expose_contradiction", "rawType": "executive_summary", "block": null, "metadata": { "slideType": "executive_summary", "slideTypeCanon": { "name": "Executive summary", "slug": "executive_summary", "status": "active", "canonId": "019de52d-06be-73ff-81b3-f99fe7f0025e", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 86, "componentCount": 10, "textChars": 2041, "nDataPoints": 6, "notes": "This is a classic short-seller research note (Muddy Waters style).", "elementsJson": [ "photo", "bullet_list", "data_table" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:33.767+00", "seconds": 5.303, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/2", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-2", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "NQ is a massive fraud. We believe it is a “Zero”. At least 72% of NQ’s purported 2012 China security revenue is fictitious.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:48+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc6-949665168082", "parentComponentId": null }, { "bbox": { "h": 0.21, "w": 0.37, "x": 0.116, "y": 0.09 }, "kind": "image", "text": "NQ Mobile office sign", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Photo", "slug": "photo", "status": "active", "canonId": "019de52c-fd37-757f-b4a8-ca26d4888875", "version": 1, "description": null }, "framework": null }, "subkind": "photo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.767+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9cdadf0f-f666-4830-8e5e-d83ac4b6b3db", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.25, "x": 0.12, "y": 0.325 }, "kind": "list", "text": "Company: NQ Mobile Inc. Ticker: NQ Industry: Mobile Security Thesis: Strong Sell Report Date: October 24, 2013 Target Price: < $1 Stock Price: $22.88 Market Cap: $1.1 Billion Float: 31.1 Million Avg Volume: 4.9 Million", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.767+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "fa7ce577-03ca-4b01-98b7-c9d4c79cbbff", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Target Price: <$1", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:48+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc6-9b6be5f32e87", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.45, "x": 0.45, "y": 0.73 }, "kind": "paragraph", "text": "NQ’s future is as bleak as its past. The recent pivot to advertising and gaming is merely an attempt to change to a fraud that NQ hopes will be less obvious. NQ cannot monetize users that it does not have.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.767+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "23dd9677-6439-4562-b541-0b458d8b836f", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.45, "x": 0.45, "y": 0.8 }, "kind": "paragraph", "text": "NQ’s acquisitions are highly likely to be corrupt.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.767+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "56193727-d8dd-4e67-b655-510d50865e48", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.45, "x": 0.45, "y": 0.64 }, "kind": "paragraph", "text": "NQ’s purported international revenue of $36.5 million is likely less real than its PRC revenue. NQ claims to generate international revenue in obscure markets, and through mysterious counterparties that seem to seldom pay.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.767+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8fdb233e-0e88-4b46-bdfe-ac75822a0596", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.45, "x": 0.45, "y": 0.83 }, "kind": "paragraph", "text": "NQ’s cash balances are highly likely to not be real. In NQ’s 2012 20-F, PwC classified all cash and term deposits as Level 2 assets (slightly hard to value), which is the first time we have seen this. NQ’s purported movements of cash from its IPO almost certainly did not occur due to PRC FX controls. We therefore believe the term deposits are likely forgeries.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.767+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b58aebbd-e142-4903-9b65-cd93c13bef75", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.45, "x": 0.45, "y": 0.32 }, "kind": "paragraph", "text": "NQ is a massive fraud. We believe it is a “Zero”. At least 72% of NQ’s purported 2012 China security revenue is fictitious. NQ’s largest customer by far is really NQ. Our research estimates that NQ’s real market share in China is only about 1.5%, versus the approximately 55% it reports. We estimate that its China paying user base is less than 250,000, versus the six million NQ claims.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.767+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d1382460-8b7e-45f9-ae32-eeeba9e03248", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.45, "x": 0.45, "y": 0.48 }, "kind": "paragraph", "text": "NQ’s Antivirus 7.0 is unsafe for sale to consumers, and we consider it to be spyware that makes users’ phones vulnerable to cyber attack. NQ makes a weak attempt to protect users’ private data as it’s uploaded through the Chinese government’s firewall to NQ’s server. Phones are vulnerable to MITM attacks because NQ fails to adhere to basic security protocols. MW engaged top-flight security software engineers to analyze this product.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.767+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "dd64a8da-294a-4aa9-a027-695ae7a1f07c", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "a5bf7a19-6693-42c4-a56e-5730553d8422", "evidence": "The slide systematically lists reasons why the company is a fraud (revenue, security, cash, acquisitions).", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:33.767+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 2, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 3, "type": "tension", "title": "This is a classic short-seller research note (Muddy Waters style) exposing corporate malfeasance.", "function": "name_villain", "rawType": "villain_critique", "block": null, "metadata": { "slideType": "villain_critique", "slideTypeCanon": { "name": "Villain critique", "slug": "villain_critique", "status": "active", "canonId": "019de52d-10bc-7136-bf20-09de59d17447", "version": 1, "description": null }, "function": "name_villain", "functionCanon": { "name": "Name villain", "slug": "name_villain", "status": "active", "canonId": "019de52d-1746-70d6-bc58-5eeaf5865526", "version": 1, "description": null }, "density": "dense", "densityScore": 50, "componentCount": 7, "textChars": 922, "nDataPoints": 6, "notes": "This is a classic short-seller research note (Muddy Waters style) exposing corporate malfeasance.", "elementsJson": [ "headline_text", "paragraph" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 21:28:38.849+00", "seconds": 14.631, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/3", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-3", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "At least 72% of NQ's purported China security revenue is fictitious.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:49+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc7-4b5d3ac50c56", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "market share: 1.5%", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:49+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc7-4ee69f5f7bb6", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.78, "x": 0.11, "y": 0.13 }, "kind": "paragraph", "text": "NQ is a massive fraud. We believe it is a “Zero”. At least 72% of NQ’s purported China security revenue is fictitious. NQ’s largest customer by far is really NQ. Its real business with carriers and SPs is a fraction of what NQ purports.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 21:28:38.849+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "396a2eca-d0e5-4333-874a-5a3792110178", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.78, "x": 0.11, "y": 0.3 }, "kind": "paragraph", "text": "NQ’s Antivirus 7.0 is unsafe for sale to consumers, and we consider it to be spyware. We engaged a group of top-tier specialized software engineers to dive deeply into the application’s code.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 21:28:38.849+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "713b0509-9676-4fd5-8ee8-a2bf3b369095", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.78, "x": 0.11, "y": 0.57 }, "kind": "paragraph", "text": "NQ’s purported international revenue is even more questionable than its PRC revenue. A leading Android analytics provider estimates that NQ’s global annual app revenue is well under $1.0 million.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 21:28:38.849+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a0729662-5844-460f-80c9-c58089242e88", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.78, "x": 0.11, "y": 0.74 }, "kind": "paragraph", "text": "NQ’s future is as bleak as its past. Its expansion into gaming and advertising is merely an attempt to prolong the fraud. NQ’s lies about its security app market share have worn very thin.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 21:28:38.849+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cfd9167d-a5b1-4b8c-8743-ee1c4b367582", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.34, "x": 0.33, "y": 0.09 }, "kind": "title", "text": "NQ Mobile: China Fraud 2.0", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 21:28:38.849+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cc1810bb-2c2f-4e1a-a824-22d80a2573c5", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "ae099c11-b953-4074-b55c-c1c5e06b3d89", "evidence": "The document systematically dismantles the company's financial claims and product integrity.", "framework": null, "confidence": 1, "extraction": { "at": "2026-05-02 21:28:38.849+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 3, "frameworkName": "fraud-exposure" } ], "arcBeats": [ { "to": 5, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 3, "name": "Villain Critique", "beatId": "a3eb7938-be35-4f27-9905-62d9f98704b3", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document critiques NQ Mobile's management and business practices.", "position": 1, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 4, "type": "tension", "title": "This is a page from a short-seller research report (likely Muddy Waters or similar) exposing corporate malfeasance.", "function": "name_villain", "rawType": "villain_critique", "block": null, "metadata": { "slideType": "villain_critique", "slideTypeCanon": { "name": "Villain critique", "slug": "villain_critique", "status": "active", "canonId": "019de52d-10bc-7136-bf20-09de59d17447", "version": 1, "description": null }, "function": "name_villain", "functionCanon": { "name": "Name villain", "slug": "name_villain", "status": "active", "canonId": "019de52d-1746-70d6-bc58-5eeaf5865526", "version": 1, "description": null }, "density": "balanced", "densityScore": 43, "componentCount": 6, "textChars": 1100, "nDataPoints": 1, "notes": "This is a page from a short-seller research report (likely Muddy Waters or similar) exposing corporate malfeasance.", "elementsJson": [ "paragraph" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:32.33+00", "seconds": 3.357, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/4", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-4", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "With one exception, NQ's real management (i.e., those perpetrating the fraud) are sloppy – to the point of being comical – fraudsters.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:48+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc6-76501a0073b8", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.8, "x": 0.1, "y": 0.48 }, "kind": "paragraph", "text": "NQ's auditor has clearly done a sloppy job. The auditor failed to ensure that disclosures about cash balances by entity are correct. It permitted NQ to reclassify significant costs from Cost of Sales to R&D.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.33+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "08788f92-7329-4a3d-99cc-f706e09b297d", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.8, "x": 0.1, "y": 0.76 }, "kind": "paragraph", "text": "NQ's cash balances are highly likely to not exist. The classification of all of NQ's cash and equivalents as Level 2 assets raises massive red flags.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.33+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "405de10f-dfd2-4483-9e31-c0e2d78a98e0", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.8, "x": 0.1, "y": 0.35 }, "kind": "paragraph", "text": "The one intelligent move NQ made to further its fraud is putting in place the veneer of US management – particularly “Co-CEO” Omar Khan. It is clear that his stock package is worth close to $100 million.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.33+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a71172a2-145d-46d9-8362-9f7a45cb65ba", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.8, "x": 0.1, "y": 0.63 }, "kind": "paragraph", "text": "NQ's acquisitions are highly likely to be corrupt. Analysis of SAIC files of certain of NQ's acquisitions shows inconsequential businesses with very little capitalization.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.33+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b828490d-ab72-4b3c-b7f8-cfe119e8f91b", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.8, "x": 0.1, "y": 0.1 }, "kind": "paragraph", "text": "With one exception, NQ's real management (i.e., those perpetrating the fraud) are sloppy – to the point of being comical – fraudsters. They broke – with flying colors – the cardinal China fraud rule of not getting into trouble in China.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.33+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c8d90cc7-5102-4d97-8f13-b19cd0bc8984", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Villain slide", "slug": "villain-slide", "status": "active", "bestFor": "In activist decks where the personality matters", "canonId": "019dd9e1-518c-7404-976a-5be5a517b659", "version": 1, "bodyDocId": null, "description": "A dedicated slide presenting the named villain visually", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "648b112e-4a65-4bf4-ab09-c58f7611fd98", "evidence": "The slide presents a critical view of NQ's management, labeling them as 'sloppy' and 'comical' fraudsters, which aligns with the characteristics of a villain slide.", "pageRefs": null, "priority": null, "whenToUse": "In activist decks where the personality matters", "confidence": 0.9, "extraction": { "at": "2026-07-16 22:57:28.913642+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 4, "whyItWorks": "Makes the antagonist concrete", "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [ { "matchId": "5f258ce9-18c6-449e-8be4-18e2b2c29257", "evidence": "Systematic breakdown of management, auditor, and operational failures to prove fraud.", "framework": null, "confidence": 0.95, "extraction": { "at": "2026-05-02 20:51:32.33+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 4, "frameworkName": "fraud-exposure" } ], "arcBeats": [ { "to": 5, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 3, "name": "Villain Critique", "beatId": "a3eb7938-be35-4f27-9905-62d9f98704b3", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document critiques NQ Mobile's management and business practices.", "position": 1, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 5, "type": "setup", "title": "The document structure is highly accusatory, focusing on fraud allegations, financial irregularities, and operational failures.", "function": "front_matter", "rawType": "table_of_contents", "block": null, "metadata": { "slideType": "table_of_contents", "slideTypeCanon": { "name": "Table of contents", "slug": "table_of_contents", "status": "active", "canonId": "019de52d-0643-721b-9b85-69676bb85cf8", "version": 1, "description": null }, "function": "front_matter", "functionCanon": { "name": "Front matter", "slug": "front_matter", "status": "active", "canonId": "019de52d-133d-73f0-9e26-201eda96b098", "version": 1, "description": null }, "density": "balanced", "densityScore": 37, "componentCount": 6, "textChars": 990, "nDataPoints": 0, "notes": "The document structure is highly accusatory, focusing on fraud allegations, financial irregularities, and operational failures.", "elementsJson": [ "headline_text", "data_table" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:32.34+00", "seconds": 3.281, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/5", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-5", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": { "h": 0.08, "w": 0.766, "x": 0.117, "y": 0.41 }, "kind": "list", "text": "NQ'S INTERNATIONAL REVENUE - HIGHLY LIKELY TO BE MASSIVELY OVERSTATED...37\nTHE FARCICAL SIDE...41\nNQ'S 3-15 DNA - VIDEO AVAILABLE AT: HTTPS://VIMEO.COM/77704496...45\nUS MANAGEMENT IS MERELY A FRONT...46", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.34+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3c31a140-515b-417a-ad53-34653eb5bf30", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.766, "x": 0.117, "y": 0.725 }, "kind": "list", "text": "APPENDIX A: U.S. STORE VISITS...61\nAPPENDIX B: SAIC FINANCIAL FRAUD INDICIA...67\nAPPENDIX C: SOFTWARE ENGINEER REPORT...71", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.34+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "66b50e4e-374d-49da-a385-ee4a9ae071e7", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.766, "x": 0.117, "y": 0.128 }, "kind": "list", "text": "THE VAST MAJORITY OF NQ'S CHINA REVENUE IS FRAUDULENT...6\nYDT IS REALLY NQ...14\nNQ'S THIRD PARTY PAYMENT CHANNEL IS NON-EXISTENT...17\nNQ'S CHINA PREPAID CARD CHANNEL DOES NOT CONTRIBUTE MATERIALLY TO REVENUE...19", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.34+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "82e28486-ce99-4be3-8fe7-7fa6f2d6c713", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.766, "x": 0.117, "y": 0.51 }, "kind": "list", "text": "NQ'S CASH BALANCE (A LEVEL 2 ASSET) IS HIGHLY LIKELY TO BE FRAUDULENT...48\nNQ'S LIKELY CORRUPT ACQUISITIONS...53\nNQ'S FUTURE IS AS BLEAK AS ITS PAST...55\nNQ'S FILINGS MAKE CLEAR THAT PWC'S AUDITS WERE SLOPPY...57", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.34+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bdae9623-2522-49aa-96be-671a44015147", "parentComponentId": null }, { "bbox": { "h": 0.11, "w": 0.766, "x": 0.117, "y": 0.295 }, "kind": "list", "text": "NQ IS AN OBSCURE COMPANY IN CHINA WITH MINIMAL BRAND RECOGNITION...25\nNQ'S SAIC FINANCIALS ARE FRAUDULENT...32\nNQ'S ANTIVIRUS 7.0 MAKES IT EASY FOR THE PRC GOVERNMENT AND HACKERS TO READ COPIOUS AMOUNTS OF SENSITIVE DATA...33", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.34+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f18b94e4-b2a6-4ec4-bda3-b8cc5e98eeef", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.155, "x": 0.117, "y": 0.098 }, "kind": "title", "text": "Table of Contents", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.34+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bf7435ee-4581-4e39-98d0-81b1f8c8525a", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 5, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 3, "name": "Villain Critique", "beatId": "a3eb7938-be35-4f27-9905-62d9f98704b3", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document critiques NQ Mobile's management and business practices.", "position": 1, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 6, "type": "tension", "title": "The slide uses a forensic accounting approach to expose the discrepancy between reported revenue and actual business operations.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "dense", "densityScore": 52, "componentCount": 7, "textChars": 974, "nDataPoints": 8, "notes": "The slide uses a forensic accounting approach to expose the discrepancy between reported revenue and actual business operations.", "elementsJson": [ "headline_text", "paragraph", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:32.228+00", "seconds": 3.14, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/6", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-6", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "We conclude that at least 72% of NQ’s reported $32.2 million in 2012 China security software is fraudulent.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:49+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc6-eb86791e09e3", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "China revenue: 72%", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:49+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc6-ecb273bca805", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.8, "x": 0.1, "y": 0.45 }, "kind": "paragraph", "text": "NQ's largest customer is really NQ. NQ secretly controls a shell company called Yidatong (\"YDT\"). NQ claims that YDT is an independent company, and accounted for $20.2 million in 2012 revenue.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.228+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6367e005-a370-428c-9569-e3b52c418e3b", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.8, "x": 0.1, "y": 0.25 }, "kind": "paragraph", "text": "NQ reported $32.2 million in security software revenue in 2012 from China. We believe that NQ's real security revenue was $2.5 million to $7.7 million (7.8% to 23.9% of reported revenue).", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.228+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "888076e2-5b0e-428e-b721-ff77d0a2f14b", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.8, "x": 0.1, "y": 0.15 }, "kind": "paragraph", "text": "We conclude that at least 72% of NQ's reported $32.2 million in 2012 China security software is fraudulent. SAIC financials for Yidatong, its largest customer, NQ's enterprise and gaming companies, NationSky and FL Mobile, show indicia of fraud.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.228+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8a43adfa-e66f-4041-87ac-03c1c1d722ec", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.8, "x": 0.1, "y": 0.82 }, "kind": "source-note", "text": "1 NQ March 2013 investor presentation. 2 Wireless Value-Added Application Service Channel Cooperation Agreement... 3 Accounting Standards for Enterprises No. 14 - Revenues.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.228+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5f1dd6b9-1595-4afa-81f1-36c25df987cb", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.8, "x": 0.1, "y": 0.08 }, "kind": "title", "text": "The Vast Majority of NQ's China Revenue is Fraudulent", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.228+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "12cb9c5c-9a52-4b68-9e7d-42fa5f4ff7f1", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "ed6042d1-acdd-40ca-b3da-66deeb73bfa0", "evidence": "The slide systematically deconstructs reported revenue figures against physical due diligence and financial analysis to prove fraud.", "framework": null, "confidence": 0.95, "extraction": { "at": "2026-05-02 20:51:32.228+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 6, "frameworkName": "fraud-exposure" } ], "arcBeats": [ { "to": 15, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 6, "name": "Expose Contradiction", "beatId": "950a2373-b77d-4c00-b8fc-2af98761fe7c", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document presents several contradictions in NQ Mobile's financials and business practices.", "position": 0, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 7, "type": "tension", "title": "The slide uses forensic accounting logic to expose inconsistencies between SAIC filings and NQ's public claims.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "dense", "densityScore": 55, "componentCount": 5, "textChars": 2723, "nDataPoints": 6, "notes": "The slide uses forensic accounting logic to expose inconsistencies between SAIC filings and NQ's public claims.", "elementsJson": [ "paragraph", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:37.936+00", "seconds": 8.806, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/7", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-7", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "NQ reported accounts receivable from YDT of $9.3 million as of FY 2012, but YDT’s financials show total accounts payable of $3.7 million, once again showing the fraudulent nature of NQ’s financials.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:48+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc6-c1524e40fce0", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.78, "x": 0.11, "y": 0.59 }, "kind": "paragraph", "text": "YDT's income statement is below. It generated far less revenue, and paid far less in Business Tax than it would have were NQ's claims not fraudulent.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.936+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "38775eac-f009-42fb-8cac-940ed980fa20", "parentComponentId": null }, { "bbox": { "h": 0.23, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "paragraph", "text": "According to SAIC financials, YDT only generated $2.9 million in 2012 revenue, which is 14% of what NQ purports to have generated in revenue from YDT. YDT would have had to generate at least the $20.2 million NQ purports to have generated from YDT...to say nothing of the 40% of YDT revenue purportedly attributable to other clients. YDT's Cost of Sales account would include any amounts YDT paid to NQ and its other customers. Instead, YDT generated only $2.9 million in revenue, and had Cost of Sales of only $1.8 million. NQ reported accounts receivable from YDT of $9.3 million as of FY 2012, but YDT's financials show total accounts payable of $3.7 million, once again showing the fraudulent nature of NQ's financials.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.936+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c69982cf-c231-4405-8973-1e9dd3e4cfcc", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.78, "x": 0.11, "y": 0.33 }, "kind": "paragraph", "text": "PRC GAAP requires that YDT's financial statements book revenue gross of payments to NQ and other customers. The Business Tax (sales tax) of $97,000 YDT paid was a fraction of the more than $4.0 million it would have paid if it were generating the volumes NQ claims. The lack of Business Tax payments confirms that YDT's revenue is shown in its SAIC file on a gross basis. Under the PRC tax regime, YDT pays Business Tax on the gross amount of revenue it collects from carriers. If NQ tries to argue that YDT is just your upstanding tax cheat, the argument would not hold water. The parties that purportedly pay YDT – China Mobile, China Telecom, and China Unicom – would require Business Tax invoices in order to avoid being taxed on monies paid out. For YDT to generate a Business Tax invoice, it would need to pay the tax to the Tax Bureau, which would cause it to show up in YDT's financials.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.936+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "efbc349e-a4d7-4558-9b20-7980139879e8", "parentComponentId": null }, { "bbox": { "h": 0.18, "w": 0.78, "x": 0.11, "y": 0.75 }, "kind": "source-note", "text": "4 NQ claims that YDT derives roughly 60% of its revenues from NQ. Assuming YDT only has a 10% gross margin on NQ business, YDT would generate about $35 million. See NQ “Response to J Capital Report, NQ: Not at Any Price,” August, 2013.\n5 NQ 2012 20-F, p. F-17.\n6 Accounting Standards for Enterprises No. 14 – Revenues: http://209.200.107.14/english/law2_disp.asp?sublawcode=SUB57585711610141610&lawcode=LAW3544911991291514&country=China\n7 https://www.bj.10086.cn/Portals/0/revision/images/mwsphzglssdywfc.pdf\n8 “Upstanding tax cheat” is meant to illustrate the cognitive dissonance many investors in China companies exhibit when they argue that a given company is not a fraud – it merely cheats on taxes, resulting in understated revenues on SAIC financials.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.936+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8c4d7317-ece9-4584-bdf8-896c5ff2ae5c", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "3a14565a-ebd5-40d1-9482-b8f1a7e57634", "evidence": "The slide systematically compares reported financial data against external claims to identify inconsistencies indicative of fraud.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:37.936+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 7, "frameworkName": "fraud-exposure" } ], "arcBeats": [ { "to": 15, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 6, "name": "Expose Contradiction", "beatId": "950a2373-b77d-4c00-b8fc-2af98761fe7c", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document presents several contradictions in NQ Mobile's financials and business practices.", "position": 0, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 8, "type": "analysis", "title": "The slide provides raw financial data to support a claim that YDT is a 'ghost company' and that NQ's reported accounts receivable from YDT are inconsistent with", "function": "analyze_data", "rawType": "appendix_data", "block": null, "metadata": { "slideType": "appendix_data", "slideTypeCanon": { "name": "Appendix data", "slug": "appendix_data", "status": "active", "canonId": "019de52d-078a-745b-9ee4-c15f2f539acd", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "balanced", "densityScore": 36, "componentCount": 5, "textChars": 770, "nDataPoints": 120, "notes": "The slide provides raw financial data to support a claim that YDT is a 'ghost company' and that NQ's reported accounts receivable from YDT are inconsistent with YDT's reported payables.", "elementsJson": [ "data_table", "paragraph" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:31.815+00", "seconds": 2.567, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/8", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-8", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "YDT is a ghost company (because it is really NQ). We tried extremely hard to find its operations, but were unsuccessful, despite visiting ten different office addresses throughout China.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:49+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc7-35da33615302", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.74, "x": 0.13, "y": 0.37 }, "kind": "paragraph", "text": "YDT's balance sheet below shows total payables that are a fraction of what NQ claims its AR from YDT were at the end of 2012. NQ purports that its AR from YDT was $9.3 million.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:31.815+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "50bc2c48-10ad-4eba-a7ec-50380f8c7e7c", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.74, "x": 0.13, "y": 0.85 }, "kind": "paragraph", "text": "YDT is a ghost company (because it is really NQ). We tried extremely hard to find its operations, but were unsuccessful, despite visiting ten different office addresses throughout China. We obtained these addresses from YDT's SAIC filings, its website, NQ's SEC filings, and other sources. Five of the addresses were ghost addresses – i.e., it would have been", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:31.815+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6acb5aff-8f49-4cf8-a6ee-b5ae75c14540", "parentComponentId": null }, { "bbox": { "h": 0.42, "w": 0.74, "x": 0.13, "y": 0.42 }, "kind": "table", "text": "Balance Sheet 2010-2012", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:31.815+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2be6e97a-84c6-4380-8f8d-c123843fff52", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.74, "x": 0.13, "y": 0.09 }, "kind": "table", "text": "Income Statement 2010-2012", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:31.815+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "aabae5fd-523f-41ae-b0fc-a9123828940a", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 15, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 6, "name": "Expose Contradiction", "beatId": "950a2373-b77d-4c00-b8fc-2af98761fe7c", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document presents several contradictions in NQ Mobile's financials and business practices.", "position": 0, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 9, "type": "tension", "title": "The text highlights the discrepancy between NQ's claims about YDT's revenue contribution and the physical evidence of non-existent office operations.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 75, "componentCount": 8, "textChars": 2926, "nDataPoints": 1, "notes": "The text highlights the discrepancy between NQ's claims about YDT's revenue contribution and the physical evidence of non-existent office operations.", "elementsJson": [ "paragraph", "bullet_list", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:33.821+00", "seconds": 4.46, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/9", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-9", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "YDT is clearly a company trying not to be found.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:50+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc7-5e98cfca9e07", "parentComponentId": null }, { "bbox": { "h": 0.28, "w": 0.75, "x": 0.14, "y": 0.21 }, "kind": "list", "text": "turn on the lights, answer phones, reconcile billing issues with carriers, order office supplies, pay vendors, develop and implement marketing programs, sell services to new and existing customers, handle inquiries from existing customers, and (duties from NQ's purported contract with YDT): maintain the value-added technology platform, technology platform interface; provide verification codes for related products and technology support to customers; coordinate with telecom operators to ensure the testing and activation of client business; negotiate and communicate with telecom operators; maintain the revenue and flow search pages for customers; delete non-existent or discontinued users; review customers' marketing methods; oversee customers' compliance; develop, maintain, ensure stability and responsiveness of the information platform.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.821+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b61b7095-197a-4f93-86e2-36a0c0dc406d", "parentComponentId": null }, { "bbox": { "h": 0.09, "w": 0.78, "x": 0.11, "y": 0.55 }, "kind": "paragraph", "text": "We explored several permutations of the address for YDT's headquarters in Tianjin, before finding it in the Tianjin Haosheng Building. Because the lobby directory still had the prior tenant's name plate posted for room 502-2, and the office door located off a narrow, dingy hallway was unmarked, we thought it was another dead end. However, when queried, the building's management office confirmed that YDT did indeed rent room 502-2.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.821+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "15a97b97-3b03-4425-8308-93bba9eff4e7", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "paragraph", "text": "impossible for YDT to ever be there because the addresses did not exist. (Ghost addresses are a theme that runs throughout our due diligence on NQ.) YDT's offices are either non-existent or completely empty. NQ claims that YDT accounted for roughly 15% of NQ's Q1 2013 revenue; yet, YDT is clearly incapable of processing meaningful amounts of payments on behalf of NQ because it does not have even one employee regularly present to:", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.821+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2b602e30-9875-4306-868f-9fc9a08704ba", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.78, "x": 0.11, "y": 0.5 }, "kind": "paragraph", "text": "(On the positive side, it appears as though YDT's business model does not call for any human resource employees, which is an innovative approach to cost saving.)", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.821+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6fdd40f0-a8ab-4b60-b788-e4b862518d5a", "parentComponentId": null }, { "bbox": { "h": 0.13, "w": 0.78, "x": 0.11, "y": 0.65 }, "kind": "paragraph", "text": "The manager of the building in which YDT has its headquarters said “this is just the registered address, but nobody works here...They all work in Beijing it seems, all of them, this is just the registered address, this is not their workplace, it's in Beijing”. However, the YDT employees do not work in Beijing...or Shanghai...or Xi'an...or any of the nine purported YDT addresses we found. YDT is clearly a company trying not to be found. Below is a summary of our site visit attempts and findings. Actually, it is not really a company – we suspect that the meager revenue and expenses it did show were run through its books for reasons unconnected to its purported operations.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.821+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d013b05a-b085-4625-8c6b-ba24ba205800", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "“this is just the registered address, but nobody works here...They all work in Beijing it seems, all of them, this is just the registered address, this is not their workplace, it’s in Beijing” — Manager of the building in which YDT has its headquarters.", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:50+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc7-633f688f2083", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.45, "x": 0.11, "y": 0.89 }, "kind": "source-note", "text": "9 NQ “Response to J Capital Report, NQ: Not at Any Price,” August, 2013.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.821+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6ca5d38b-7337-4981-936f-6e95e18f084e", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 15, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 6, "name": "Expose Contradiction", "beatId": "950a2373-b77d-4c00-b8fc-2af98761fe7c", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document presents several contradictions in NQ Mobile's financials and business practices.", "position": 0, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 10, "type": "tension", "title": "The slide serves as evidence of fraudulent or non-existent corporate presence at claimed addresses.", "function": "expose_contradiction", "rawType": "appendix_data", "block": null, "metadata": { "slideType": "appendix_data", "slideTypeCanon": { "name": "Appendix data", "slug": "appendix_data", "status": "active", "canonId": "019de52d-078a-745b-9ee4-c15f2f539acd", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "sparse", "densityScore": 8, "componentCount": 3, "textChars": 233, "nDataPoints": 0, "notes": "The slide serves as evidence of fraudulent or non-existent corporate presence at claimed addresses.", "elementsJson": [ "data_table", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:31.646+00", "seconds": 2.193, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/10", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-10", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Ghost address. Building 9 does not exist.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:50+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc7-a04e43985e15", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.8, "x": 0.1, "y": 0.85 }, "kind": "source-note", "text": "10 http://www.xizhi.com/COMDAEKVQEBAAK4M69/, http://beijing.youbian.com/huangye/info592868/ 11 http://bj.gsdpw.com/...", "attrs": { "numbered": true }, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:31.646+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b2bc071c-480a-4d9b-9398-9e7cd80b9dfa", "parentComponentId": null }, { "bbox": { "h": 0.8, "w": 0.8, "x": 0.1, "y": 0.1 }, "kind": "table", "text": "Table listing Yidatong addresses, notes on site verification, and sources.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:31.646+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4b57b6ef-4e17-4483-98d1-10aeda025c11", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 15, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 6, "name": "Expose Contradiction", "beatId": "950a2373-b77d-4c00-b8fc-2af98761fe7c", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document presents several contradictions in NQ Mobile's financials and business practices.", "position": 0, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 11, "type": "tension", "title": "The slide serves as a forensic investigation of corporate addresses.", "function": "expose_contradiction", "rawType": "preempt_rebuttal", "block": null, "metadata": { "slideType": "preempt_rebuttal", "slideTypeCanon": { "name": "Preempt rebuttal", "slug": "preempt_rebuttal", "status": "active", "canonId": "019de52d-1225-7368-af32-6381fddabdb3", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "sparse", "densityScore": 5, "componentCount": 2, "textChars": 149, "nDataPoints": 0, "notes": "The slide serves as a forensic investigation of corporate addresses.", "elementsJson": [ "data_table", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:35.636+00", "seconds": 6.117, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/11", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-11", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": { "h": 0.1, "w": 0.8, "x": 0.1, "y": 0.85 }, "kind": "source-note", "text": "Footnotes 12-16 detailing specific online research sources.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.636+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "59ad103d-2350-429c-be56-4ff754560888", "parentComponentId": null }, { "bbox": { "h": 0.75, "w": 0.8, "x": 0.1, "y": 0.09 }, "kind": "table", "text": "Table listing Yidatong locations, reported addresses, investigation findings, and sources.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.636+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "156d848e-c70d-47fe-b338-da3783ea5dd5", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "2f4de96c-3245-453a-8f5d-df36494ec11b", "evidence": "Systematic debunking of corporate addresses to prove non-existence.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:35.636+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 11, "frameworkName": "fraud-exposure" } ], "arcBeats": [ { "to": 15, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 6, "name": "Expose Contradiction", "beatId": "950a2373-b77d-4c00-b8fc-2af98761fe7c", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document presents several contradictions in NQ Mobile's financials and business practices.", "position": 0, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 12, "type": "tension", "title": "The slide presents evidence of a fake address and billing discrepancies to support a short-seller thesis.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "dense", "densityScore": 62, "componentCount": 8, "textChars": 1002, "nDataPoints": 16, "notes": "The slide presents evidence of a fake address and billing discrepancies to support a short-seller thesis.", "elementsJson": [ "data_table", "paragraph", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:36.783+00", "seconds": 7.261, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/12", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-12", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "This contradiction affirms our conclusion that YDT is a sham counterparty.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc8-cbde0a976655", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Days Sales Outstanding: 167 days", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc8-d04fd6b6cc4a", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.8, "x": 0.1, "y": 0.3 }, "kind": "paragraph", "text": "We subscribed to NQ’s paid mobile apps via carrier billing on 17 different prepaid SIMs in order to see whether YDT shows up as the SP. Unsurprisingly, it did not.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.783+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bb5ec6e1-342a-401a-ac6c-ba998d80509f", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.8, "x": 0.1, "y": 0.81 }, "kind": "paragraph", "text": "The days sales outstanding from YDT stood at 167 days at December 31, 2012, despite the purported contract between NQ and YDT requiring settlement within 30 days. This contradiction affirms our conclusion that YDT is a sham counterparty.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.783+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cdece55d-a1ce-4852-b6ab-cb949a5a887d", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "The office of the Community Residents' Committee located nearby never heard of the company Yidatong and one member became borderline irate by the suggestion that Yidatong could be located at the same address as the school.", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc8-ce1a5b057d51", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.8, "x": 0.1, "y": 0.88 }, "kind": "source-note", "text": "17 NQ 2012 20-F, Exhibit 10.11, p. 6. In addition, an Agreement between NQ and China Mobile also has terms of 45 days. NQ 2012 20-F, Exhibit 10.13, p. 8.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.783+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5d80c56c-40da-46b0-8ba0-50ef83a2aead", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.6, "x": 0.2, "y": 0.37 }, "kind": "table", "text": "Table showing Operator, Province, SP No., and Service Provider for 16 test cases.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.783+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "983e4a81-9b1c-4a72-a247-14630993a423", "parentComponentId": null }, { "bbox": { "h": 0.18, "w": 0.8, "x": 0.1, "y": 0.09 }, "kind": "table", "text": "Address verification table for Yidatong.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.783+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a1fddd0e-2be0-4db0-96b0-b741f750c56e", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 15, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 6, "name": "Expose Contradiction", "beatId": "950a2373-b77d-4c00-b8fc-2af98761fe7c", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document presents several contradictions in NQ Mobile's financials and business practices.", "position": 0, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 13, "type": "tension", "title": "This is a text-heavy research note page, likely part of a short-seller report.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 75, "componentCount": 9, "textChars": 1501, "nDataPoints": 3, "notes": "This is a text-heavy research note page, likely part of a short-seller report.", "elementsJson": [ "paragraph", "bullet_list", "footnote" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:33.611+00", "seconds": 4.009, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/13", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-13", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "The contracts between NQ and YDT are sham contracts.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:50+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc7-b7ecdd9c90ea", "parentComponentId": null }, { "bbox": { "h": 0.11, "w": 0.75, "x": 0.14, "y": 0.36 }, "kind": "list", "text": "China Telecom was not included in the original contract... In the first contract, there was no mention of who owned the registered users... The arbitration clause was drafted in a way that could make any arbitration award unenforceable.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.611+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c4b0518a-e240-456c-9aa1-fc8de137a049", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "paragraph", "text": "The contractual requirement is one of several data points we identified evidencing that NQ's audit is materially deficient.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.611+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "28eeb0f5-15ca-47b3-9591-7c02c9579326", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.27 }, "kind": "paragraph", "text": "The contracts between NQ and YDT are sham contracts. NQ has executed two contracts for domestic business with YDT... the following sloppy errors in the contracts exist because the contracts were never intended to govern a real business relationship.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.611+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7136dad5-e0e1-4491-b0b3-41c2b7c776df", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.16 }, "kind": "paragraph", "text": "The high DSO from YDT does not relate to international (i.e., non-PRC) business... NQ investor relations informs investors that all of YDT's purported revenue is from PRC revenues.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.611+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8018b8a0-0a92-4ff7-a052-6e44723d5424", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.49 }, "kind": "paragraph", "text": "YDT's purported application lineup shows that even if someone were trying to operate it as a business, it would fall far short of generating the approximately $35 million total revenue NQ claims YDT generates as a SP.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.611+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a2dc17dc-4c53-4e0e-840f-0b0823a9dffd", "parentComponentId": null }, { "bbox": { "h": 0.09, "w": 0.78, "x": 0.11, "y": 0.68 }, "kind": "paragraph", "text": "The claim that NQ would have needed to work with YDT does not hold water. YDT is supposed to be a \"Service Provider\" (\"SP\")... Around 2006, China's SPs began to die out as content", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.611+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e83f16df-fc70-4953-ae05-24c60c719840", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.78, "x": 0.11, "y": 0.61 }, "kind": "paragraph", "text": "NQ and YDT have a history of suspect financial dealings. YDT received \"advances\" from NQ each year between and including 2007 to 2011 in amounts totaling approximately $5.0 million.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.611+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ef29bb91-4732-4722-9398-103adfdcf712", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.35, "x": 0.11, "y": 0.88 }, "kind": "source-note", "text": "18 NQ 2012 20-F, Exhibit 10.10. 19 2011 IPO prospectus, pp. F-25,F-26, Notes 5 and 8", "attrs": { "numbered": true }, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.611+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b5c4409e-f975-48e5-9edb-352eb50726e8", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 15, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 6, "name": "Expose Contradiction", "beatId": "950a2373-b77d-4c00-b8fc-2af98761fe7c", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document presents several contradictions in NQ Mobile's financials and business practices.", "position": 0, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 14, "type": "tension", "title": "The slide uses forensic evidence (shared phone numbers, email servers, and office locations) to expose a corporate fraud scheme.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "balanced", "densityScore": 40, "componentCount": 5, "textChars": 1171, "nDataPoints": 3, "notes": "The slide uses forensic evidence (shared phone numbers, email servers, and office locations) to expose a corporate fraud scheme.", "elementsJson": [ "paragraph", "bullet_list", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:32.562+00", "seconds": 2.91, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/14", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-14", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "The answer to the question posed is that YDT is not a real company. Its purpose is to assist NQ in defrauding investors.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:50+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc7-8a510661e336", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.8, "x": 0.11, "y": 0.55 }, "kind": "list", "text": "As of December 2011, the Guangdong branch of China Mobile showed YDT and NQ both as being based at NQ's Beijing office, with the same phone numbers, and the same contact person (Chen An An). A list of service providers that China Mobile publishes for Fujian province listing of Service Providers show that YDT's telephone and fax numbers are (tel) 010-8565-5555 and (fax) 010-8565-5518. NQ's Chinese webpage lists those very same numbers as it main numbers on its Contact page. YDT's email server is the exact same server as NQ's.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.562+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1cc7277c-e0db-42ce-b456-f89f67d62953", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.8, "x": 0.11, "y": 0.4 }, "kind": "paragraph", "text": "In August, 2013, NQ blatantly lied to investors about the nature of its relationship to YDT. NQ was responding to a limited circulation research report that raised a number of questions about the Company, including its relationship with YDT. YDT is one of the worst disguised related parties we have encountered in our years of trawling the sewers of US-listed China companies. The key is YDT's 75% owner, Ms. Rong Xu. Ms. Xu also previously worked at NQ.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.562+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1fc76a1a-1dce-4306-b372-21398f75f518", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.8, "x": 0.11, "y": 0.77 }, "kind": "source-note", "text": "Footnotes 20-26 detailing sources for the claims.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.562+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "926bb18e-716a-47e7-864e-54c80875d446", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.2, "x": 0.11, "y": 0.37 }, "kind": "title", "text": "YDT is really NQ.", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.562+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "17ae997a-8699-4a8a-a22a-2e4428c0a643", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "f3036a25-3dad-4867-9492-496c3fbba92c", "evidence": "The slide explicitly argues that YDT is a vehicle for defrauding investors through undisclosed related party transactions.", "framework": null, "confidence": 1, "extraction": { "at": "2026-05-02 20:51:32.562+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 14, "frameworkName": "fraud-exposure" } ], "arcBeats": [ { "to": 15, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 6, "name": "Expose Contradiction", "beatId": "950a2373-b77d-4c00-b8fc-2af98761fe7c", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document presents several contradictions in NQ Mobile's financials and business practices.", "position": 0, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 15, "type": "tension", "title": "Includes technical evidence (ping results) showing shared server IP addresses.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "balanced", "densityScore": 26, "componentCount": 5, "textChars": 764, "nDataPoints": 0, "notes": "Includes technical evidence (ping results) showing shared server IP addresses.", "elementsJson": [ "screenshot", "bullet_list", "paragraph", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:32.798+00", "seconds": 3.135, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/15", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-15", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "In reality, Ms. Xu’s involvement with NQ is not just overlap – it is entanglement.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:51+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc7-f97325d4e357", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.52, "x": 0.24, "y": 0.08 }, "kind": "image", "text": "Ping results showing mail.yidatone.com and mail.netqin.com resolve to the same IP address.", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.798+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b511ae2d-b9c8-4f94-aa58-00a7cd958bd4", "parentComponentId": null }, { "bbox": { "h": 0.52, "w": 0.72, "x": 0.14, "y": 0.36 }, "kind": "list", "text": "Evidence points: shared customer service number, shared contact person (Wang Qiu), shared email domain (netqin.com), interest-free loans, and false claims regarding Ms. Rong Xu's involvement.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.798+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "db681dd9-502c-40f1-826a-8f3f91a5fdb0", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "Ms. Xu worked at NQ for less than six months, as marketing director, and then left NQ in 2007 in order to buy her stake in YDT; YDT is a separate and completely independent business from NQ; and NQ accounts for only 60% of YDT’s revenue. — NQ “Response to J Capital Report, ‘NQ Not At Any Price,’” August, 2013.", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:51+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc7-fd2ece167f4b", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.6, "x": 0.14, "y": 0.89 }, "kind": "source-note", "text": "Footnotes 27, 28, 29 citing MIIT, Zhejiang Communications Administration, and NQ response.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:32.798+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "be46d58a-885e-46d7-9176-1ef5b19627c3", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 15, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 6, "name": "Expose Contradiction", "beatId": "950a2373-b77d-4c00-b8fc-2af98761fe7c", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document presents several contradictions in NQ Mobile's financials and business practices.", "position": 0, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 16, "type": "tension", "title": "The slide uses a series of bullet points to systematically dismantle NQ's narrative about Ms. Xu's departure and role.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "balanced", "densityScore": 41, "componentCount": 7, "textChars": 809, "nDataPoints": 0, "notes": "The slide uses a series of bullet points to systematically dismantle NQ's narrative about Ms. Xu's departure and role.", "elementsJson": [ "bullet_list", "paragraph", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:36.151+00", "seconds": 6.209, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/16", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-16", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "It is clear that Ms. Xu is part of the inner circle of NQ, and not just the marketing advisor NQ claimed.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:50+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc7-cd62b38521aa", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.72, "x": 0.14, "y": 0.115 }, "kind": "list", "text": "Ms. Xu became involved with YDT far earlier than when NQ claims she left. In February 2006, Ms. Xu is shown as YDT's Executive Director.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.151+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "00f45464-c007-4b93-9887-a6eecf144464", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.72, "x": 0.14, "y": 0.515 }, "kind": "list", "text": "Ms. Xu was still a Senior Vice President at NQ well into 2008, approximately one year after NQ claims she left.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.151+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0626f621-7dad-4d30-ae8d-cbe2d4108dce", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.72, "x": 0.14, "y": 0.445 }, "kind": "list", "text": "Ms. Xu became YDT's Legal Representative in February 2007; however, NQ awarded her stock options for her 'services' in a company that was not established until March 14, 2007.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.151+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "09c35be6-0257-452d-b55a-3efbffeb4226", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.72, "x": 0.14, "y": 0.2 }, "kind": "list", "text": "Ms. Xu was director of a company that came to own 25% of NQ in 2006. Yiteng Beijing Technology Co. Ltd. came to own 25% of NQ.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.151+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4d50320e-9088-4a43-82ec-59009196453e", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.76, "x": 0.12, "y": 0.6 }, "kind": "paragraph", "text": "The following is a relationship graph showing part of the web of NQ inner circle members:", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.151+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4e7663ef-9f76-4fa4-9ef9-62493fada4bc", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.76, "x": 0.12, "y": 0.82 }, "kind": "source-note", "text": "Footnotes 30-34 detailing SAIC files, ownership, and news articles.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.151+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "27ecd422-a8e8-4a90-8e88-1f861687909a", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 17, "type": "tension", "title": "Includes a network diagram of individuals and entities, followed by anecdotal evidence of personal relationships and a failed attempt to use the company's payme", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "dense", "densityScore": 67, "componentCount": 8, "textChars": 1448, "nDataPoints": 4, "notes": "Includes a network diagram of individuals and entities, followed by anecdotal evidence of personal relationships and a failed attempt to use the company's payment portal.", "elementsJson": [ "process_diagram", "paragraph", "quote_block" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:33.374+00", "seconds": 3.429, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/17", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-17", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "NQ's third party payment channel is non-existent and its China payment portal is purely cosmetic.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:51+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc8-474ec1c1703b", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.7, "x": 0.15, "y": 0.08 }, "kind": "diagram", "text": "Network diagram of individuals and entities", "attrs": null, "canon": { "kind": { "name": "Diagram", "slug": "diagram", "status": "active", "canonId": "019de52c-f9f0-734a-81de-15382ff28c65", "version": 1, "description": "Schematic or relational diagram." }, "tool": null, "subkind": { "name": "Process flow", "slug": "process", "status": "active", "canonId": "019de52d-039c-718f-ad3a-efe9c4b3c838", "version": 1, "description": null }, "framework": null }, "subkind": "process", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.374+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "83a7b276-23ca-494b-bf04-6d428a257544", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.8, "x": 0.1, "y": 0.7 }, "kind": "paragraph", "text": "In reality, NQ's carrier billing channel generated $2.5 million to $7.7 million in 2012, versus the $27.9 NQ purports.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.374+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "04329d44-e67d-405f-92a7-c1711424e3e4", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.8, "x": 0.1, "y": 0.35 }, "kind": "paragraph", "text": "As shown in the graph above, Ms. Xu is involved in three companies with NQ co-founder and director Zhou Xu. It appears that Mr. Zhou and Ms. Xu presently share office space...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.374+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "32013d41-b856-4c86-985d-c1411ead914c", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.8, "x": 0.1, "y": 0.8 }, "kind": "paragraph", "text": "NQ's third party payment channel is non-existent and its China payment portal is purely cosmetic. We therefore extrapolate that this channel provides no revenue to NQ...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.374+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a62fbc13-9507-44b1-892c-233ed01cb455", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.7, "x": 0.15, "y": 0.5 }, "kind": "quote", "text": "Dear brothers and sisters, after sharpening our blade for ten years, today we entered NYC...", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": null, "subkind": { "name": "Pull quote", "slug": "pull-quote", "status": "active", "canonId": "019de52c-fbf9-76fe-97e1-a0b7540445c9", "version": 1, "description": null }, "framework": null }, "subkind": "pull-quote", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.374+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "32594eca-d1af-4346-b6b2-688c5981550c", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "Dear brothers and sisters, after sharpening our blade for ten years, today we entered NYC, my heart is pounding, awash in emotion, the great dream in my heart, friends fighting together shoulder by shoulder, there glorious future is before us, and in ‘13 you will see 9H. — Mr. Xu Zhou, 5/3/2011; 5/5, IPO day in New York, overflowing with excitement, the red five-starred banner waving in the wind, and the traders are grinning. Family and dear friends lend support, keep the price up throughout the night, keep the numbers across screen continuously flashing green. We are rejoicing. We are moving down the path to success, a brilliant future is dawning - - 9H is next, go go go! — Ms. Rong Xu, 5/4/2010", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:51+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc8-4ba4b83c3fd0", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.5, "x": 0.1, "y": 0.76 }, "kind": "title", "text": "NQ's Third Party Payment Channel is Non-Existent.", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.374+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b7b0551e-5823-4f9f-a698-4757bcd7bbff", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 18, "type": "tension", "title": "This is a text-heavy research note page detailing investigative findings regarding NQ Mobile's alleged fraud.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "dense", "densityScore": 70, "componentCount": 8, "textChars": 1646, "nDataPoints": 6, "notes": "This is a text-heavy research note page detailing investigative findings regarding NQ Mobile's alleged fraud.", "elementsJson": [ "paragraph", "footnote" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:33.685+00", "seconds": 3.634, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/18", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-18", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "The NQ payment portal's lack of functionality is clear affirmation that NQ is a fraud.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:51+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc8-2c724658da3e", "parentComponentId": null }, { "bbox": { "h": 0.11, "w": 0.78, "x": 0.11, "y": 0.34 }, "kind": "paragraph", "text": "In committing fraud, it can be almost as important to avoid legitimate transactions as to record fake ones. We theorize that the reason NQ's payment portal does not work is that it would make it more difficult to fool its auditor if NQ were receiving legitimate payments...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.685+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0dc547ac-dd21-417b-b0a5-64aec49d6eda", "parentComponentId": null }, { "bbox": { "h": 0.13, "w": 0.78, "x": 0.11, "y": 0.19 }, "kind": "paragraph", "text": "The NQ payment portal's lack of functionality is clear affirmation that NQ is a fraud. The cosmetic portal calls to mind John Hempton of Bronte Capital's exposé of Universal Travel Group... It does not process payments, and NQ's customers have not noticed because, by and large, they do not exist.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.685+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3c62cc8b-b7db-4ab0-9982-be7678fb5177", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.61 }, "kind": "paragraph", "text": "NQ's claims that its security apps are on approximately 55% of smart phones in China is patently false. Two independent market research firms have pegged NQ's market share as less than 35% - often much less. Our own surveys... yield market share of only 1%.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.685+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b02fba62-fb67-4a75-a1f4-dbe908bfd1f8", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "paragraph", "text": "service. Alipay customer service stated that NQ is not a partnering merchant, which contradicts NQ's claim that it partners with Alipay. NQ also claims that Yeepay, which is not shown on NQ's site, is a payment partner. Yeepay confirmed that NQ is not a partner either.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.685+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b3e7429d-bb22-4389-8d6a-82aa16570f35", "parentComponentId": null }, { "bbox": { "h": 0.07, "w": 0.78, "x": 0.11, "y": 0.47 }, "kind": "paragraph", "text": "Alexa data evidencing minimal traffic to the payment portal shows that nobody besides short sellers noticed the problem, despite NQ claiming to have approximately six million paying customers in China.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.685+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "da803707-e77c-46a8-b717-29dc4a896c71", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "Bernard Madoff claims to have executed no real trades in his fraud – likely for this reason.", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:51+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc8-327f3f3f9869", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.45, "x": 0.11, "y": 0.85 }, "kind": "source-note", "text": "35 NQ Mobile Investor Presentation 20130528, p. 13. 36 http://en.wikipedia.org/wiki/Madoff_investment_scandal 37 2012 20F. 38 iiMedia (Q2 2013) and RedTech (January 2011).", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.685+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c8bbf833-5a9f-45f0-8321-b77a28ccd818", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "7fc4b008-9257-427f-8b13-d8205deb83ab", "evidence": "The slide systematically deconstructs NQ's claims against external verification (Alipay, Yeepay, Alexa data, market surveys).", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:33.685+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 18, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 19, "type": "tension", "title": "This is a forensic research note exposing potential fraud or misrepresentation by NQ.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "balanced", "densityScore": 39, "componentCount": 5, "textChars": 1165, "nDataPoints": 1, "notes": "This is a forensic research note exposing potential fraud or misrepresentation by NQ.", "elementsJson": [ "headline_text", "paragraph", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:33.359+00", "seconds": 3.304, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/19", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-19", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "That fact alone ensures that prepaid card revenue is insignificant.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:50+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc7-e6545c724ac4", "parentComponentId": null }, { "bbox": { "h": 0.121, "w": 0.764, "x": 0.118, "y": 0.236 }, "kind": "paragraph", "text": "Prepaid cards consisted of scratch off cards and activation codes. Based on NQ customer service's difficulty in directing us to prepaid vendors in major cities, and our pre-installation channel checks, which show minimal penetration for NQ, we are skeptical that many (if any) retailers in China have access to NQ's access codes via automated systems or DVDs. Moreover, after we found the cards, we discovered that NQ only allows an account holder to use a prepaid card one time before being converted to carrier billing. That fact alone ensures that prepaid card revenue is insignificant.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.359+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8d073b74-e646-4f18-98d6-38ede7566e69", "parentComponentId": null }, { "bbox": { "h": 0.085, "w": 0.764, "x": 0.118, "y": 0.132 }, "kind": "paragraph", "text": "The purported combined amount of third party processor and prepaid card revenue in 2012 was somewhere between US$4 million to $10 million.39 NQ does not break out how much was attributable to cards, versus third party channels. (Transparency is the enemy of fraud.) We concluded that third party payment channels contribute immaterial amounts of revenue. We conclude the same for NQ's prepaid card channel.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.359+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f191f6a2-eff0-42bb-837e-97439deb72ee", "parentComponentId": null }, { "bbox": { "h": 0.012, "w": 0.185, "x": 0.118, "y": 0.895 }, "kind": "source-note", "text": "39 Senior management comment.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.359+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cb95151a-9921-4c25-95b8-6d2521a77d48", "parentComponentId": null }, { "bbox": { "h": 0.021, "w": 0.685, "x": 0.118, "y": 0.096 }, "kind": "title", "text": "NQ's China prepaid card channel does not contribute materially to revenue.", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Action title", "slug": "action-title", "status": "active", "canonId": "019de52c-fb31-734c-a0f5-a3935b73135d", "version": 1, "description": null }, "framework": null }, "subkind": "action-title", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.359+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d8a3c1b6-94dd-4a66-9347-f79ce721dbd3", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "b78d2ae7-060a-4465-980b-c6fbf391cf87", "evidence": "The slide uses investigative findings to challenge the legitimacy of reported revenue streams.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:33.359+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 19, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 20, "type": "tension", "title": "The slide uses a 'Wheel of Fortune' metaphor to mock the company's customer service responses.", "function": "expose_contradiction", "rawType": "villain_critique", "block": null, "metadata": { "slideType": "villain_critique", "slideTypeCanon": { "name": "Villain critique", "slug": "villain_critique", "status": "active", "canonId": "019de52d-10bc-7136-bf20-09de59d17447", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "sparse", "densityScore": 21, "componentCount": 5, "textChars": 579, "nDataPoints": 0, "notes": "The slide uses a 'Wheel of Fortune' metaphor to mock the company's customer service responses.", "elementsJson": [ "headline_text", "paragraph", "photo" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:34.2+00", "seconds": 3.858, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/20", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-20", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": { "h": 0.05, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "callout", "text": "Want to stump NQ customer service? Ask them where to buy prepaid cards in Beijing, Shanghai, or Guangzhou.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": null, "subkind": { "name": "Primary callout", "slug": "primary", "status": "active", "canonId": "019de52c-fbd1-70eb-a9ce-8997f8674c1d", "version": 1, "description": null }, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.2+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "872a3776-9365-4ced-8c7d-71061d8736af", "parentComponentId": null }, { "bbox": { "h": 0.48, "w": 0.78, "x": 0.11, "y": 0.145 }, "kind": "image", "text": "Wheel of Excuses graphic", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Illustration", "slug": "illustration", "status": "active", "canonId": "019de52c-fe76-7772-a5ac-c0b7294d7615", "version": 1, "description": null }, "framework": null }, "subkind": "illustration", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.2+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "abf64e9b-9abf-4741-a5f4-c13eb1c1ae5f", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.78, "x": 0.11, "y": 0.87 }, "kind": "paragraph", "text": "Despite apparently being NQ's exclusive vendor in Beijing, the seller is located in a spartan kiosk (B 1088) in the basement of a computer mall in the Zhongguancun section of Haidian", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.2+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3639266f-d5af-4f8f-a81f-b633d5de9f61", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.78, "x": 0.11, "y": 0.645 }, "kind": "paragraph", "text": "We made four calls to customer service to inquire about where to buy prepaid cards in Beijing, Shanghai, Shijiazhuang (a large city near Beijing), and Guangzhou. In every case, including for Beijing (NQ's headquarters), customer service was unaware...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.2+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5a8193ea-30ca-46a2-8858-e130b290b4f8", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.76, "x": 0.12, "y": 0.165 }, "kind": "title", "text": "WHEEL OF EXCUSES", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.2+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "35685457-f4c2-4b79-a574-9dc8fc92b9a1", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 21, "type": "tension", "title": "The slide uses field research/interviews to cast doubt on the legitimacy of the reported distribution network.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "dense", "densityScore": 66, "componentCount": 9, "textChars": 1243, "nDataPoints": 0, "notes": "The slide uses field research/interviews to cast doubt on the legitimacy of the reported distribution network.", "elementsJson": [ "paragraph", "comparison_table", "screenshot" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:34.216+00", "seconds": 3.869, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/21", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-21", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Sellers report very few sales.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc8-e9fa2db1b526", "parentComponentId": null }, { "bbox": { "h": 0.29, "w": 0.78, "x": 0.11, "y": 0.31 }, "kind": "image", "text": "Photos of Beijing kiosk and Guangzhou store", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Photo", "slug": "photo", "status": "active", "canonId": "019de52c-fd37-757f-b4a8-ca26d4888875", "version": 1, "description": null }, "framework": null }, "subkind": "photo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.216+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0c92bcae-3b85-4f3c-98c1-a70bed6a3ef0", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "paragraph", "text": "District, Beijing. (Of note, NQ's registered addresses for the WFOE and VIE are also in Zhongguancun.) This seller sells no products or services except for NQ cards, although the stand appears to be under common ownership with the kiosk on its right.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.216+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1ad6f0ef-006b-4d5e-8244-b0b62a67fd81", "parentComponentId": null }, { "bbox": { "h": 0.07, "w": 0.78, "x": 0.11, "y": 0.18 }, "kind": "paragraph", "text": "Whereas the Beijing seller's kiosk embraced a minimalist aesthetic, the Guangzhou seller looks like a Costco, featuring a virtual cornucopia of products available for sale.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.216+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "80812f69-8ba6-415b-a4d8-01885f5de3a0", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.65 }, "kind": "paragraph", "text": "We interviewed both vendors about the prepaid cards and learned that neither sells very many cards, and neither thought there were other vendors nearby. The Guangzhou seller said she was not sure whether there were other distributors nearby.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.216+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "92a9bcc5-c7b9-4b4e-b276-ed95af5060cb", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.74 }, "kind": "paragraph", "text": "The Beijing seller echoed the Guangzhou seller, stating that while there were some sales, they do not sell a lot, and not for much profit. Mr. Zhang, the vendor, indicated people who do buy tend to be customers who already knew the product.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.216+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bc863534-d5a1-4e9e-8039-c792bfa576f8", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.78, "x": 0.11, "y": 0.88 }, "kind": "source-note", "text": "40 In China vendors of a specific product type typically group together and a popular product will quickly spread throughout a marketplace and to other similar markets as well.", "attrs": { "numbered": true }, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.216+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e5b04854-f0bb-4d10-9039-013a393a9d70", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.78, "x": 0.11, "y": 0.28 }, "kind": "table", "text": "NQ's China Prepaid Card Distributors in Beijing and Guangzhou", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.216+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d7278bb8-966b-49ff-b0c6-c454e2490994", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.3, "x": 0.11, "y": 0.61 }, "kind": "title", "text": "Sellers report very few sales.", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Action title", "slug": "action-title", "status": "active", "canonId": "019de52c-fb31-734c-a0f5-a3935b73135d", "version": 1, "description": null }, "framework": null }, "subkind": "action-title", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.216+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "58b25e31-5429-43a6-a472-63cd34eca333", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 22, "type": "tension", "title": "The slide uses physical evidence (old logo cards) to argue that the company's retail presence is a facade for investors rather than a real business.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "dense", "densityScore": 50, "componentCount": 7, "textChars": 1235, "nDataPoints": 0, "notes": "The slide uses physical evidence (old logo cards) to argue that the company's retail presence is a facade for investors rather than a real business.", "elementsJson": [ "photo", "paragraph", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:34.535+00", "seconds": 3.895, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/22", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-22", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "NQ's lack of physical presence and virtually non-existent effort to update its merchandise, or build out its retail distribution are a clear sign their fraud is not focused on Chinese consumers, but rather US investors.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:51+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc8-741c6acbd7b7", "parentComponentId": null }, { "bbox": { "h": 0.38, "w": 0.48, "x": 0.26, "y": 0.11 }, "kind": "image", "text": "Photograph of various prepaid cards with different logos and denominations.", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Photo", "slug": "photo", "status": "active", "canonId": "019de52c-fd37-757f-b4a8-ca26d4888875", "version": 1, "description": null }, "framework": null }, "subkind": "photo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.535+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "897802c2-719a-4b9e-8df0-9ee865858224", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.78, "x": 0.11, "y": 0.78 }, "kind": "paragraph", "text": "NQ's lack of physical presence and virtually non-existent effort to update its merchandise, or build out its retail distribution are a clear sign their fraud is not focused on Chinese consumers, but rather US investors.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.535+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4526fbe1-3f9e-416d-8895-ac63ea7c5c78", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.78, "x": 0.11, "y": 0.46 }, "kind": "paragraph", "text": "The one-year prepaid NQ card (above, left) is a dead giveaway that hardly anybody ever buys these cards. The sell thru rate of these cards appears to be very low as the cards on the left still bear the old logo.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.535+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6e3300db-2dfb-4a6d-9a49-d3135ec00250", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.78, "x": 0.11, "y": 0.71 }, "kind": "paragraph", "text": "While conducting this research we learned that NQ produces prepaid phone cards for China Mobile that enable anonymous calling – these are most likely to be used by telephone spammers.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.535+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8887f6fd-c176-4706-98c3-0ad83eb11050", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.78, "x": 0.11, "y": 0.58 }, "kind": "paragraph", "text": "The RMB 13 cards contain an interesting clue. The bottom left corner contains the logo for the company that owns the kiosk, Beijing Huahui Yunzhen. That indicates that as insignificant as Huahui is, it occupies a rarified place in the pantheon of NQ’s business partners.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.535+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e93f0b2a-b9d1-462e-b960-046714ad3fc8", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.4, "x": 0.11, "y": 0.89 }, "kind": "source-note", "text": "http://www.chinascopefinancial.com/en/news/post/12668.html", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.535+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5f8b977c-bd75-475f-be25-208c9e72778b", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "45f45972-16b3-4cc6-8e70-66f2ec26f659", "evidence": "The slide uses physical evidence to expose a discrepancy between the company's claimed retail operations and the reality of its outdated, low-volume merchandise.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:34.535+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 22, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 23, "type": "tension", "title": "This is a page from a short-seller research report (likely Muddy Waters or similar) investigating NQ Mobile.", "function": "expose_contradiction", "rawType": "research-note", "block": null, "metadata": { "slideType": "research-note", "slideTypeCanon": null, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "dense", "densityScore": 69, "componentCount": 7, "textChars": 3198, "nDataPoints": 3, "notes": "This is a page from a short-seller research report (likely Muddy Waters or similar) investigating NQ Mobile.", "elementsJson": [ "paragraph", "footnote" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:35.086+00", "seconds": 4.259, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/23", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-23", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": { "h": 0.05, "w": 0.78, "x": 0.11, "y": 0.54 }, "kind": "callout", "text": "NQ’s online (lack of) card sales affirms our physical store checks that show the cards are obscure and immaterial to NQ revenue.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": null, "subkind": { "name": "Primary callout", "slug": "primary", "status": "active", "canonId": "019de52c-fbd1-70eb-a9ce-8997f8674c1d", "version": 1, "description": null }, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.086+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "827c8dbd-1f25-4e98-8d0c-bfda2ed5c3aa", "parentComponentId": null }, { "bbox": null, "kind": "callout", "text": "NQ's online (lack of) card sales affirms our physical store checks that show the cards are obscure and immaterial to NQ revenue.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc8-9beec52ca1ca", "parentComponentId": null }, { "bbox": { "h": 0.28, "w": 0.78, "x": 0.11, "y": 0.25 }, "kind": "paragraph", "text": "After asking investor relations for information on China prepaid card sales and sellers, customer service began refusing to discuss prepaid cards. October 14, 2013, we called customer service again to inquire about card sellers in other cities. The service representative said to us that they only provide technical support for the products and do not engage in sales, instead kept referring the customer to other sales channels. While on the surface this response appears relatively benign, their prior willingness to help check, identify, and contact us through follow-up communication was noticeably absent. We believe this was a result of a corporate directive to forbid further disclosure of details on the Company’s prepaid card distribution (or lack thereof). This lasted for a few days. Then customer service changed its tune again, urging callers to buy prepaid cards for China Mobile, China Unicom, and China Telecom to pay for NQ apps. We believe that NQ was preparing for being exposed as having no real prepaid card sales by being able to retort “You do not understand our business; prepaid cards also include carriers’ cards”. To the extent this is true, it is a payment method only a few days old.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.086+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8c694b72-b0c4-4eb8-a234-1feac465034e", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.78, "x": 0.11, "y": 0.77 }, "kind": "paragraph", "text": "Taobao also provides seller data analytics. Below is the sales data for the three sellers. Beijing Huahui Yunzhen is the kiosk we visited in Beijing. The Beijing NQ card distributor sells not just NQ products but also cell phone recharge cards. Of the prior six months’ 48 reported sales, only 11 sales were for NQ cards. NQ Card Agent’s Taobao year-to-date sales are only 348.5 RMB, approximately $57.13 (fifty seven dollars and thirteen cents). Performance at their sister company was equally dismal. The Guangzhou kiosk has not made a single sale on Taobao since April of this year.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.086+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c54b9362-27c6-4ac8-b948-c4ab248e1278", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.78, "x": 0.11, "y": 0.61 }, "kind": "paragraph", "text": "Taobao Marketplace is owned by Alibaba, and is a very large, reputable website in China similar to both Ebay and Amazon. It dominates China’s online B2C and C2C markets. We found only three sellers of NQ prepaid cards listed on Taobao Marketplace, and we believe two of these sites belong to the Beijing NQ Card Distributor. All three sites show meager sales at best. (Consistent with our view that the anonymous phone cards are not a Kosher business in China, there seem to be no NQ anonymous card sellers on Taobao.) One of the sellers, “NQ Card Agent” prominently displays a card with the old logo.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.086+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "dbdec457-e3cb-4333-8968-c8077c651dc6", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "paragraph", "text": "impression is that customer service gets few calls overall, and that calls about prepaid cards are far rarer. Investor relations had seemed willing to arrange appointments with purported vendors, but as any investor who was burned in companies such as China Biotics and China MediaExpress will attest, such prearranged meetings can easily be frauds as well. The investor responded by asking for names and contact information so that we could secretly shop the vendors. Investor relations has not responded.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.086+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "df972134-2241-4206-a854-34dca4db4444", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.25, "x": 0.11, "y": 0.93 }, "kind": "source-note", "text": "42 http://en.wikipedia.org/wiki/Taobao", "attrs": { "numbered": true }, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.086+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7ffe091d-12bf-4518-8f25-5f5579010396", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 24, "type": "analysis", "title": "The table highlights low sales volume for NQ products, supporting the thesis of an anemic market presence.", "function": "analyze_data", "rawType": "precedent_table", "block": null, "metadata": { "slideType": "precedent_table", "slideTypeCanon": { "name": "Precedent table", "slug": "precedent_table", "status": "active", "canonId": "019de52d-115e-757e-a38f-486981054171", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "balanced", "densityScore": 34, "componentCount": 5, "textChars": 723, "nDataPoints": 60, "notes": "The table highlights low sales volume for NQ products, supporting the thesis of an anemic market presence.", "elementsJson": [ "data_table", "paragraph" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:33.005+00", "seconds": 2.126, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/24", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-24", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "NQ's physical and online presence in China is at best anemic. NQ's inability to cultivate a sales ecosystem suggests that neither retailers nor consumers are interested in selling or buying NQ products.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:51+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc8-5fd30a512853", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "NQ Card Sales: 67", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:51+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc8-62ebbbd63416", "parentComponentId": null }, { "bbox": { "h": 0.07, "w": 0.78, "x": 0.11, "y": 0.83 }, "kind": "paragraph", "text": "NQ's physical and online presence in China is at best anemic. NQ's inability to cultivate a sales ecosystem suggests that neither retailers nor consumers are interested in selling or buying NQ products.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.005+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "07b0f4d4-b13a-43ae-baad-b56e0f346b7e", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.78, "x": 0.11, "y": 0.71 }, "kind": "paragraph", "text": "A review of rough comparables on Taobao further suggests that the online market for premium or even moderately priced mobile phone software for Chinese consumers is very small, and pricing is competitive.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.005+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b1f24e70-3907-454f-a42b-979e8beaae8d", "parentComponentId": null }, { "bbox": { "h": 0.58, "w": 0.78, "x": 0.11, "y": 0.11 }, "kind": "table", "text": "Monthly sales data for NQ Card Agents: NQ Card Agent, Beijing Huahui Yunzhen, Guangzhou Lixingjing", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.005+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "09de2872-c037-473d-a0d6-4f8927821a98", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 25, "type": "tension", "title": "This is a text-heavy research note page from a short-seller report (Muddy Waters). It uses a 'preempt_rebuttal' strategy to defend its survey methodology.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 79, "componentCount": 9, "textChars": 1792, "nDataPoints": 6, "notes": "This is a text-heavy research note page from a short-seller report (Muddy Waters). It uses a 'preempt_rebuttal' strategy to defend its survey methodology.", "elementsJson": [ "headline_text", "paragraph", "footnote" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:34.778+00", "seconds": 3.787, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/25", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-25", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Muddy Waters’s survey-based market research estimates that NQ’s actual share of the China security app market is 1.4%, versus NQ’s purported approximate share of approximately 55%.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc8-ac59d5d64f4b", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "market share: 1.4%", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc8-b42077100c0d", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.8, "x": 0.1, "y": 0.18 }, "kind": "paragraph", "text": "Muddy Waters’s survey-based market research estimates that NQ’s actual share of the China security app market is 1.4%, versus NQ’s purported approximate share of approximately 55%. Based on our research, we estimate that NQ has fewer than 250,000 paying customers in China, versus its claim of six million.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.778+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0048c73b-2197-47d4-a417-1d94b787a176", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.8, "x": 0.1, "y": 0.58 }, "kind": "paragraph", "text": "NQ might criticize our survey sample as being too small to be significant; however, this sample size is large enough to reject with 95% confidence a null hypothesis of NQ’s market share being far, far lower than NQ claims. The key is the massive delta between what NQ claims and what we found. There is no way to bridge that gap.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.778+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bebdb4c1-6077-4987-b054-04c4e172da78", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.8, "x": 0.1, "y": 0.7 }, "kind": "paragraph", "text": "NQ might criticize our survey sample as being geographically flawed... Moreover, NQ has refused to disclose any information on where in China it actually has market share. (Transparency is the enemy of fraud.)", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.778+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e9c73e83-69fd-415e-870f-15dd2a6b33c3", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.8, "x": 0.1, "y": 0.35 }, "kind": "paragraph", "text": "Our research shows that NQ’s China market share claims of approximately 55% are ludicrous, as are its claims of having approximately six million paying users. Our surveys of over 800 respondents from five cities show that NQ’s share of the China mobile security app market is only 1.4%. In contrast, Qihoo 360 Technology Co. Ltd. (NASDAQ: QIHU) has 73.5% market share in our survey, followed by Tencent Holding Ltd. (HK: 700) at 15.7%, Kingsoft Corp. Ltd. (HK: 3888) at 4.9%, and “other” at 3.8%.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.778+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f4e154da-07db-4665-a64e-090a9a26e425", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "(Transparency is the enemy of fraud.) — Muddy Waters", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc8-b39b021c1954", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.2, "x": 0.1, "y": 0.88 }, "kind": "source-note", "text": "43 QIHU 2012 20-F, p. 27. 44 Q2 2013.", "attrs": { "numbered": true }, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.778+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "43ddbb16-7a5e-43d9-b374-083fa7f2c808", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.8, "x": 0.1, "y": 0.09 }, "kind": "title", "text": "NQ is an Obscure Company in China with Minimal Brand Recognition; Our Research Estimates that Fewer than 1.5% of Smart Phone Owners Presently have a NQ Security App.", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.778+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d88da7ce-fb77-4f30-b02f-941a3e936ee0", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "28553a64-2e6c-450a-8162-25f5b01ff3c9", "evidence": "The text explicitly anticipates and refutes two potential criticisms: sample size and geographic bias.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:34.778+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 25, "frameworkName": "preempt_rebuttal" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 26, "type": "analysis", "title": "The text explicitly justifies the selection of Zhejiang province as a 'pro-NQ' bias to ensure the survey results are conservative.", "function": "diagnose_problem", "rawType": "appendix_methodology", "block": null, "metadata": { "slideType": "appendix_methodology", "slideTypeCanon": { "name": "Appendix methodology", "slug": "appendix_methodology", "status": "active", "canonId": "019de52d-07d9-726c-8599-167f2d2ffaa7", "version": 1, "description": null }, "function": "diagnose_problem", "functionCanon": { "name": "Diagnose problem", "slug": "diagnose_problem", "status": "active", "canonId": "019de52d-176d-761f-b608-cf52262d2ab2", "version": 1, "description": null }, "density": "balanced", "densityScore": 48, "componentCount": 5, "textChars": 1689, "nDataPoints": 4, "notes": "The text explicitly justifies the selection of Zhejiang province as a 'pro-NQ' bias to ensure the survey results are conservative.", "elementsJson": [ "paragraph", "footnote" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:34.559+00", "seconds": 3.46, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/26", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-26", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "If NQ wants to dispute our conclusion that it has laughably low penetration rates in China, actions speak louder than words.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc9-010c0e9105e0", "parentComponentId": null }, { "bbox": { "h": 0.075, "w": 0.764, "x": 0.118, "y": 0.327 }, "kind": "paragraph", "text": "If NQ wants to dispute our conclusion that it has laughably low penetration rates in China, actions speak louder than words. Investor relations should refrain from hemming and hawing about the samples we have taken, and tell us exactly where in China NQ has high penetration rates. Anything else NQ says to try to refute this point is a waste of toner.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.559+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2852b74e-2996-43f6-9ad8-4fff2778c41d", "parentComponentId": null }, { "bbox": { "h": 0.215, "w": 0.764, "x": 0.118, "y": 0.112 }, "kind": "paragraph", "text": "With NQ refusing to provide any detail on its China markets, we chose three of the four Tier 1 cities: Beijing (NQ's hometown), Shanghai, and Shenzhen. We then chose two cities in Zhejiang province as the respective representative Tier 3 and Tier 4 cities: Ningbo and Huzhou. We chose Zhejiang because it was the most pro-NQ means we could think of doing the survey. NQ previously announced its first major nationwide sales promotion and established an agreement with the Zhejiang-branch of China National Postal and Telecommunications (PTAC) to pair up NQ software with 3G cell phones PTAC was distributing. Ningbo (about 2.5 hours drive from Shanghai) has a population of 7.6 million, 3.5 million of whom reside in the urban areas. Ningbo's 2011 per capita GDP was RMB 79,500 (Shanghai's was RMB 82,600). Huzhou (about one hour drive from Shanghai) population is 2.6 million, with an urban population of 1.1 million. Huzhou's 2011 per capita GDP was RMB 58,500.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.559+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f7154b1a-b228-40d9-b08c-9db187164589", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "\"3G leads to an explosion in the security market! Cell phone security software suites are on fire!\" — July 22, 2009, http://www.enet.com.cn/article/2009/0722/A20090722505055.shtml.", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc9-07effdc5f5a6", "parentComponentId": null }, { "bbox": { "h": 0.105, "w": 0.764, "x": 0.118, "y": 0.825 }, "kind": "source-note", "text": "45-49: Citations for 3G market, Ningbo/Huzhou population and GDP data.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:34.559+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ae1d908a-1337-4251-bfc9-80f0ff1531f8", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "bf7f44af-f32c-4e62-aeb2-2ff86284fb3c", "evidence": "The authors describe their survey methodology as a test to validate their hypothesis of low market penetration.", "framework": null, "confidence": 0.8, "extraction": { "at": "2026-05-02 20:51:34.559+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 26, "frameworkName": "diagnostic-test" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 27, "type": "analysis", "title": "The slide presents two sets of pie charts: one for general adoption (Yes/No/Don't Know) and one for brand market share (Qihoo 360, QQ/Tencent, etc.) segmented b", "function": "analyze_data", "rawType": "appendix_data", "block": null, "metadata": { "slideType": "appendix_data", "slideTypeCanon": { "name": "Appendix data", "slug": "appendix_data", "status": "active", "canonId": "019de52d-078a-745b-9ee4-c15f2f539acd", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "balanced", "densityScore": 27, "componentCount": 5, "textChars": 363, "nDataPoints": 32, "notes": "The slide presents two sets of pie charts: one for general adoption (Yes/No/Don't Know) and one for brand market share (Qihoo 360, QQ/Tencent, etc.) segmented by city tier.", "elementsJson": [ "pie_chart" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:33.499+00", "seconds": 2.322, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/27", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-27", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": { "h": 0.2, "w": 0.8, "x": 0.09, "y": 0.35 }, "kind": "chart", "text": "Adoption pie charts for Overall, Tier 1, Tier 3, Tier 4", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Pie chart", "slug": "pie", "status": "active", "canonId": "019de52c-ffdb-71bb-a800-5c5ab9f1c373", "version": 1, "description": null }, "framework": null }, "subkind": "pie", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.499+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "35b056f4-fd49-4e1c-81dc-778b81d5fd91", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.8, "x": 0.09, "y": 0.7 }, "kind": "chart", "text": "Brand share pie charts for Overall, Tier 1, Tier 3, Tier 4", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Pie chart", "slug": "pie", "status": "active", "canonId": "019de52c-ffdb-71bb-a800-5c5ab9f1c373", "version": 1, "description": null }, "framework": null }, "subkind": "pie", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.499+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cea3dd68-15be-4a30-bd24-9a1f840b1182", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "market share: 1%", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc9-18ae41e382ca", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.7, "x": 0.09, "y": 0.268 }, "kind": "paragraph", "text": "Q: Does your mobile phone have any security, antivirus, or data protection software? (Multiple choice.)", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.499+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "295eb23d-9af8-4b32-86c4-a260936b5895", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.8, "x": 0.09, "y": 0.635 }, "kind": "paragraph", "text": "Q: Which company’s security, AV, data protection app is on your mobile phone? (Multiple choice, more than one selection permitted.)", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:33.499+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "704a1273-e96a-4c84-ac84-af1b8f48e089", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 28, "type": "analysis", "title": "The slide contains two rows of pie charts, each row showing an 'Overall' view followed by 'Tier 1', 'Tier 3', and 'Tier 4' breakdowns.", "function": "analyze_data", "rawType": "appendix_data", "block": null, "metadata": { "slideType": "appendix_data", "slideTypeCanon": { "name": "Appendix data", "slug": "appendix_data", "status": "active", "canonId": "019de52d-078a-745b-9ee4-c15f2f539acd", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "sparse", "densityScore": 19, "componentCount": 4, "textChars": 154, "nDataPoints": 32, "notes": "The slide contains two rows of pie charts, each row showing an 'Overall' view followed by 'Tier 1', 'Tier 3', and 'Tier 4' breakdowns.", "elementsJson": [ "donut_chart" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:36.437+00", "seconds": 4.625, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/28", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-28", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": { "h": 0.25, "w": 0.86, "x": 0.09, "y": 0.43 }, "kind": "chart", "text": "Age demographic pie charts", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Pie chart", "slug": "pie", "status": "active", "canonId": "019de52c-ffdb-71bb-a800-5c5ab9f1c373", "version": 1, "description": null }, "framework": null }, "subkind": "pie", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.437+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "61e8c32f-abd0-4541-acd3-24a9bb3d6efa", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.86, "x": 0.09, "y": 0.15 }, "kind": "chart", "text": "App installation pie charts", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Pie chart", "slug": "pie", "status": "active", "canonId": "019de52c-ffdb-71bb-a800-5c5ab9f1c373", "version": 1, "description": null }, "framework": null }, "subkind": "pie", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.437+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "977ab0ce-7b17-4f9f-b62f-3ed6ec3abf56", "parentComponentId": null }, { "bbox": { "h": 0.015, "w": 0.435, "x": 0.09, "y": 0.118 }, "kind": "paragraph", "text": "Q: How was the app installed on your phone? (Multiple choice.)", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.437+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0193961d-9b52-428e-b6c6-ffb319ebdb05", "parentComponentId": null }, { "bbox": { "h": 0.015, "w": 0.335, "x": 0.09, "y": 0.4 }, "kind": "paragraph", "text": "Q: What is your age? (Multiple choice.)", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.437+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "aa61932a-9110-4151-a110-43cf09d30557", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 29, "type": "tension", "title": "The slide uses a skeptical tone to challenge the credibility of NQ's market share reports and suggests potential manipulation of retail installations.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 81, "componentCount": 10, "textChars": 1482, "nDataPoints": 6, "notes": "The slide uses a skeptical tone to challenge the credibility of NQ's market share reports and suggests potential manipulation of retail installations.", "elementsJson": [ "paragraph", "footnote" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:35.471+00", "seconds": 3.582, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/29", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-29", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Retailer Visits Further Confirm that NQ has a Sliver of the Market Share it Claims.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc9-4b5144604354", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "market share: 1.4%", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc9-4d96bd6afd66", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.8, "x": 0.1, "y": 0.4 }, "kind": "paragraph", "text": "Our examination of 113 phones at various stores across five cities in China concluded that NQ's pre-installation or bundled software channel is close to being non-existent as of Q3 2013.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.471+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "02e8ccb8-48b6-4eec-ba59-b593db514fa0", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.8, "x": 0.1, "y": 0.55 }, "kind": "paragraph", "text": "54.0% of the phones we checked had no anti-virus software on them, and only four out of 113 phones had NQ installed. We therefore theorize that NQ employees paid store employees to install the software.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.471+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "31687756-c78f-49c6-8455-454b1311563a", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.8, "x": 0.1, "y": 0.09 }, "kind": "paragraph", "text": "Note that pre-installations account for only 6.5% of the apps on phones. On one hand, this suggests that pre-installations are irrelevant to market share. Another interpretation is that NQ's claims about its pre-installations are exaggerated.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.471+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4f9d4f88-c3b1-4d79-8a1b-02e7b87fa441", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.8, "x": 0.1, "y": 0.17 }, "kind": "paragraph", "text": "NQ's massively exaggerated claims about its market share started with a Frost & Sullivan report from late 2010 or early 2011... We believe that NQ paid for this report, and that the research methodology did not involve collecting data from users.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.471+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e592517e-d016-4a0a-881a-71137dcd8d0a", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.8, "x": 0.1, "y": 0.72 }, "kind": "paragraph", "text": "The below download numbers come from two of China's largest independent app stores, Wandoujia and 91 Zhu Shou, and show that NQ has miniscule market share. NQ's “Likes” as a percentage of comments (29.66%) is among the lowest on the list.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.471+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e6de0bbf-1652-4fe2-b537-b8ae186b5098", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.8, "x": 0.1, "y": 0.88 }, "kind": "source-note", "text": "50 http://www.netqin.com/upLoad/File/en/China%20Mobile%20Security%20Market%20Research_final.pdf", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.471+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "093f69e6-314c-4fb5-a38d-050d5c645a1f", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.8, "x": 0.1, "y": 0.67 }, "kind": "title", "text": "China App Store Download Data Confirm that NQ has a Sliver of the Market Share it Claims.", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.471+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5f839ce5-386f-4421-9205-6a8eaf2bdaaf", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.8, "x": 0.1, "y": 0.35 }, "kind": "title", "text": "Retailer Visits Further Confirm that NQ has a Sliver of the Market Share it Claims.", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.471+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6c8c5fae-ea14-4be7-a27e-f7f2d11ca7de", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "fb745312-8cd2-4918-a6ee-0a6d245219ca", "evidence": "The slide systematically challenges the validity of market share claims through independent verification and logical deduction.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:35.471+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 29, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 30, "type": "analysis", "title": "The table highlights NetQin (NQ) in red text, and the text notes its negative user sentiment and ownership by BIDU.", "function": "analyze_data", "rawType": "comparison_table", "block": null, "metadata": { "slideType": "comparison_table", "slideTypeCanon": { "name": "Comparison table", "slug": "comparison_table", "status": "active", "canonId": "019de52d-0a06-73f8-8813-fe022fab1de2", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "dense", "densityScore": 64, "componentCount": 8, "textChars": 1016, "nDataPoints": 180, "notes": "The table highlights NetQin (NQ) in red text, and the text notes its negative user sentiment and ownership by BIDU.", "elementsJson": [ "headline_text", "data_table", "paragraph", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:38.373+00", "seconds": 6.311, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/30", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-30", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "We estimate that about 80% of the comments on Wandoujia regarding NQ are negative.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc9-7732f80e303c", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Total Downloads: 470,000", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc9-7db4f55308b6", "parentComponentId": null }, { "bbox": { "h": 0.07, "w": 0.78, "x": 0.11, "y": 0.49 }, "kind": "paragraph", "text": "We estimate that about 80% of the comments on Wandoujia regarding NQ are negative. Some of the more commonly used adjectives are “gangster (流氓)”, “brute (禽兽)”, “garbage (垃圾)”. A number of commenters wondered how NQ has been able to survive.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.373+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9317c1b8-aec0-4a9a-8e56-db867cde5f62", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.78, "x": 0.11, "y": 0.57 }, "kind": "paragraph", "text": "Note that 91 Zhu Shou is owned by BIDU, which has an acrimonious relationship with QIHU, which is likely the reason that QIHU is not offered in the store.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.373+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c67d31b8-a648-4649-b6ab-2063ba9d61a9", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "Some of the more commonly used adjectives are “gangster (流氓)”, “brute (禽兽)”, “garbage (垃圾)”. — Muddy Waters", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc9-7a00c8576c30", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.78, "x": 0.11, "y": 0.88 }, "kind": "source-note", "text": "One of our native Chinese speakers learned some new unflattering English adjectives by reading the reviews, and having to translate them.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.373+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d32beaef-a2c2-440f-9864-f94b29928960", "parentComponentId": null }, { "bbox": { "h": 0.36, "w": 0.78, "x": 0.11, "y": 0.11 }, "kind": "table", "text": "Table of 25 apps with columns for Chinese Name, English Translation, Total Downloads, % of Total, Downloads This Week, % of Total, Total installations, % of Total installations, # of Likes, # of Comment, Likes / Comment", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.373+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9a40b671-551b-4c64-8122-013ffb1d5d68", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.34, "x": 0.33, "y": 0.09 }, "kind": "title", "text": "Wandoujia Top 25 Mobile Security Apps (Oct. 20, 2013)", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.373+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5385f877-1175-4d27-ac86-7a88e133174a", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 31, "type": "setup", "title": "The slide highlights NQ security's low market share (1%) and includes a quote from NQ attempting to explain away discrepancies in market data.", "function": "preempt_rebuttal", "rawType": "preempt_rebuttal", "block": null, "metadata": { "slideType": "preempt_rebuttal", "slideTypeCanon": { "name": "Preempt rebuttal", "slug": "preempt_rebuttal", "status": "active", "canonId": "019de52d-1225-7368-af32-6381fddabdb3", "version": 1, "description": null }, "function": "preempt_rebuttal", "functionCanon": { "name": "Preempt rebuttal", "slug": "preempt_rebuttal", "status": "active", "canonId": "019de52d-18ab-7479-9a7e-820a2f03586a", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 79, "componentCount": 9, "textChars": 1533, "nDataPoints": 40, "notes": "The slide highlights NQ security's low market share (1%) and includes a quote from NQ attempting to explain away discrepancies in market data.", "elementsJson": [ "data_table", "paragraph", "quote_block", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:35.65+00", "seconds": 3.132, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/31", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-31", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "NQ recently addressed the paucity of downloads in these stores with a non sequitur:", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc9-29db35a68953", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "market share: 1.00%", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc9-3264ad3505da", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.76, "x": 0.12, "y": 0.62 }, "kind": "paragraph", "text": "NQ recently addressed the paucity of downloads in these stores with a non sequitur:", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.65+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "18211aaa-5c82-4c09-8edd-590e6465f365", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.76, "x": 0.12, "y": 0.82 }, "kind": "paragraph", "text": "These two stores represent over 200 million downloads of security apps, including significant downloads of apps produced by the clear market leaders, QIHU and Tencent. Again, it seems NQ wants investors to accept that there are places in China with their own very special mobile internet, and users who are super motivated to seek out NQ.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.65+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3ef8189f-e381-40de-98f3-bc69a342d1e4", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.76, "x": 0.12, "y": 0.66 }, "kind": "quote", "text": "For example, if an analyst tried to verify market share data for handsets in China... one might conclude from this faulty sampling methodology that there is no way that Huawei, ZTE, Lenovo, or Xiaomi would have the kind of market share that actually exists.", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": null, "subkind": { "name": "Pull quote", "slug": "pull-quote", "status": "active", "canonId": "019de52c-fbf9-76fe-97e1-a0b7540445c9", "version": 1, "description": null }, "framework": null }, "subkind": "pull-quote", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.65+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1201db65-a2c3-4b1d-b094-19d5891d8b01", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "For example, if an analyst tried to verify market share data for handsets in China and surveyed 1000's of people in the streets of Beijing or Shanghai, they might find results that would show 65% of users have Samsung-branded phones while 35% have Apple's iPhone. One might conclude from this faulty sampling methodology that there is no way that Huawei, ZTE, Lenovo, or Xiaomi would have the kind of market share that actually exists. — NQ \"Response to J Capital Report Titled, ‘NQ: Not At Any Price,’” August, 2013, p.2.", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc9-2c550c7eefcf", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.5, "x": 0.12, "y": 0.92 }, "kind": "source-note", "text": "52 NQ \"Response to J Capital Report Titled, ‘NQ: Not At Any Price,’” August, 2013, p.2.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.65+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1d94c76a-dfe9-4dbc-b9ad-94c0e5d855a7", "parentComponentId": null }, { "bbox": { "h": 0.45, "w": 0.76, "x": 0.12, "y": 0.15 }, "kind": "table", "text": "Table of 25 apps with download counts and percentages, highlighting NQ security at 1.00%.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.65+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0d6de41a-4264-425d-b267-626f8ab4dba7", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.6, "x": 0.2, "y": 0.1 }, "kind": "title", "text": "91 Zhu Shou Top 25 Mobile Security Apps (Oct. 20, 2013)", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.65+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a14e7204-75ad-4e77-b48b-40498316d39e", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 32, "type": "tension", "title": "This is a text-heavy research note slide detailing the methodology of identifying fraud in Chinese companies listed in the US.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 80, "componentCount": 10, "textChars": 2098, "nDataPoints": 0, "notes": "This is a text-heavy research note slide detailing the methodology of identifying fraud in Chinese companies listed in the US.", "elementsJson": [ "headline_text", "paragraph", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:37.013+00", "seconds": 4.357, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/32", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-32", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "In the case of a US-listed public company, the fraudulent books form the basis for the SEC financials. Therefore, fraudulent SAIC financials tell us that SEC financials are also fraudulent.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:53+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc9-e898accf4017", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.78, "x": 0.11, "y": 0.54 }, "kind": "paragraph", "text": "Certain of NQ's tax disclosures and accounting are significant indicia of fraud and fraudulent SAIC financials. (These misses also evidence a sloppy audit - see NQ's Filings Make Clear that PwC's Audits Were Sloppy.)", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.013+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "180eb682-89fa-442e-bfc4-cab70a4a2f08", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.78 }, "kind": "paragraph", "text": "China frauds tend to claim tax preferences for which they are not eligible. One staple of audits in China is tax payment documentation. Frauds can forge payment documentation, but motivated auditors can spot forged tax payment docs.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.013+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "44b00a4f-28c7-4ed6-8f28-8a0f0a876498", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.78, "x": 0.11, "y": 0.61 }, "kind": "paragraph", "text": "Bungled tax treatment is common in China frauds. Accounting for a fraud is much harder than accounting for a legitimate business. Business accounting is a largely rote exercise - accountants are merely documenting historical facts.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.013+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8fb15efc-c1db-4d06-b145-a96bef9d29f8", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.78, "x": 0.11, "y": 0.3 }, "kind": "paragraph", "text": "Of course we know that NQ's financials are fraudulent from having observed the Yidatong fraud, customers' inability to pay through NQ's payment portal, NQ's miniscule prepaid card sales, and the barely-existent position NQ occupies in the China market.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.013+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9c2ea992-85a0-45fa-889d-a39d0b2ca30e", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.78, "x": 0.11, "y": 0.16 }, "kind": "paragraph", "text": "NQ's SAIC financial statements largely match those in its SEC filings; however, NQ's SAIC financials are fraudulent. This means that NQ's SEC filing financials are also fraudulent.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.013+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bcfcdd8e-d45e-4c7d-bfc6-25fba8ee55e1", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.78, "x": 0.11, "y": 0.41 }, "kind": "paragraph", "text": "Chinese media called NQ's SAIC financials into question the day before NQ's IPO. The 21st Century Business Herald published an article titled 'Netqin investigation, the night prior to public listing - inflated sales proceeds.'", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.013+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e66e2515-6d59-4ae0-851c-5adf7d1fefbb", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "“Netqin investigation, the night prior to public listing - inflated sales proceeds,” 21st Century Business Herald, March 26, 2011. — 21st Century Business Herald; “Conversely, building a successful fraud is much easier than building a successful business.” — Muddy Waters", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:53+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc9-ed95d04ad6f3", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.78, "x": 0.11, "y": 0.88 }, "kind": "source-note", "text": "53 'Netqin investigation, the night prior to public listing - inflated sales proceeds,' 21st Century Business Herald, March 26, 2011. 54 Conversely, building a successful fraud is much easier than building a successful business.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.013+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ed29a66f-c762-4c7b-9519-5c43d5e6395e", "parentComponentId": null }, { "bbox": { "h": 0.07, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "title", "text": "NQ's SAIC Financials are Fraudulent, Leading to Fraudulent SEC Financials", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.013+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "743419b8-9117-4bbf-9629-7e73ad711e96", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "16bf1a13-a3d0-4628-8ca6-960ad42ddd52", "evidence": "The slide systematically links SAIC filing discrepancies to broader fraud indicators.", "framework": null, "confidence": 0.8, "extraction": { "at": "2026-05-02 20:51:37.013+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 32, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 33, "type": "tension", "title": "This is a research note page from a short-seller report (likely Muddy Waters) exposing fraudulent practices and security flaws.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "sparse", "densityScore": 14, "componentCount": 3, "textChars": 537, "nDataPoints": 0, "notes": "This is a research note page from a short-seller report (likely Muddy Waters) exposing fraudulent practices and security flaws.", "elementsJson": [ "paragraph" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:35.109+00", "seconds": 2.445, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/33", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-33", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "The encryption AV 7.0 uses is pointless because it includes the key with the data it is encrypting, which is akin to leaving the key hanging out of a safe.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc9-af84e2d75855", "parentComponentId": null }, { "bbox": { "h": 0.5, "w": 0.8, "x": 0.1, "y": 0.4 }, "kind": "paragraph", "text": "MW engaged a team of top-flight specialized software engineers to analyze potential vulnerabilities in NQ's Antivirus 7.0. Both they and we were shocked a) at the amount of sensitive data (including location data) the app collects...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.109+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d260a582-b77b-414e-897e-4b922c3332ef", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.8, "x": 0.1, "y": 0.32 }, "kind": "title", "text": "NQ's Antivirus 7.0 Makes it Easy for the PRC Government and Hackers to Read Copious Amounts of Sensitive Data, and to Upload Malware to Users' Phones", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.109+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "96cab199-cbcf-4b45-bb26-ead43ddef497", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 34, "type": "appendix", "title": "Includes Wireshark packet capture screenshots as evidence of insecure data transmission to Chinese servers.", "function": "expose_contradiction", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "dense", "densityScore": 72, "componentCount": 9, "textChars": 1727, "nDataPoints": 0, "notes": "Includes Wireshark packet capture screenshots as evidence of insecure data transmission to Chinese servers.", "elementsJson": [ "paragraph", "screenshot", "footnote" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:36.634+00", "seconds": 3.957, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/34", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-34", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "The result is that NQ users are vulnerable to Man in the Middle (\"MITM\") attack, a technique wherein a hacker impersonates the NQ server and intercepts all of the above listed data the app broadcasts.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc9-94d26380acf6", "parentComponentId": null }, { "bbox": { "h": 0.18, "w": 0.7, "x": 0.15, "y": 0.69 }, "kind": "image", "text": "Detailed packet inspection showing HTTP payload", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.634+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "35e6399c-7a06-4ab6-bd25-d3e4ec1f22aa", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.7, "x": 0.15, "y": 0.49 }, "kind": "image", "text": "Wireshark capture showing data sent to NQ's server in China", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.634+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e8736fdb-03b7-442b-96ad-5316778dc7ae", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.7, "x": 0.15, "y": 0.14 }, "kind": "paragraph", "text": "This means that all of the above user details are vulnerable to hackers sniffing the network between the user and NQ's Chinese servers, and the Chinese government. NQ sends the data as well to TalkingData.net, which is a Chinese data analytics service.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.634+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "03b4da68-5ac8-418f-9cfb-e0167858dc3b", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.7, "x": 0.15, "y": 0.34 }, "kind": "paragraph", "text": "By modifying their host file, our engineers were able to perform a MITM attack against themselves and discovered an additional special command that directs the application to download and execute any file from any server on the device.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.634+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "311655f9-ec76-414d-af6a-b3df40fac205", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.7, "x": 0.15, "y": 0.09 }, "kind": "paragraph", "text": "software that is installed and apps that are running in the phone, and information about analytics on your operation, your favorites, network connection and downloading.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.634+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "497cbcd5-2864-4106-92ec-7d3e1251a20a", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.7, "x": 0.15, "y": 0.4 }, "kind": "paragraph", "text": "Rounding out our analysis of the app / server communication protocol failures, we note that NQ does not sign its downloads. Without a digital signature, the user app has no way of authenticating the download or ensuring that it came from anyone other than NQ.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.634+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a210139b-2579-48e8-b561-8d540f5dcaf7", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.7, "x": 0.15, "y": 0.21 }, "kind": "paragraph", "text": "When downloading data from the server, NQ does not use HTTPS or SSL. The result is that NQ users are vulnerable to Man in the Middle (\"MITM\") attack, a technique wherein a hacker impersonates the NQ server and intercepts all of the above listed data the app broadcasts. NQ does encrypt the data transmission from server to app, however it includes the key used to encrypt the data as a simple encoded string broadcast along with the payload, making the encryption nearly worthless.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.634+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e8b4f763-0a1e-4da5-b0f0-0842cb034d9a", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.2, "x": 0.15, "y": 0.89 }, "kind": "source-note", "text": "http://www.nq.com/privacy", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.634+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "eabe8f8e-9eb1-4cd4-8a39-540d2351f3d3", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 35, "type": "tension", "title": "Screenshots of Wireshark packet captures showing plain text XML and HTTP traffic.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "sparse", "densityScore": 24, "componentCount": 6, "textChars": 418, "nDataPoints": 0, "notes": "Screenshots of Wireshark packet captures showing plain text XML and HTTP traffic.", "elementsJson": [ "screenshot", "paragraph" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:35.848+00", "seconds": 2.935, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/35", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-35", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "All user URL and browsing history is sent to China unencrypted, and easily decoded.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:52+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc9-63b72312b6a9", "parentComponentId": null }, { "bbox": { "h": 0.2, "w": 0.7, "x": 0.15, "y": 0.48 }, "kind": "image", "text": "Wireshark capture showing unencrypted URL/browsing history", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.848+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "267875b5-51ec-4ed5-bf26-4ff367d9f224", "parentComponentId": null }, { "bbox": { "h": 0.3, "w": 0.7, "x": 0.15, "y": 0.13 }, "kind": "image", "text": "Wireshark capture showing XML data transmission", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.848+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "77a261fb-3b87-440c-a24a-8806e58fa051", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.7, "x": 0.15, "y": 0.71 }, "kind": "paragraph", "text": "All user URL and browsing history is sent to China unencrypted, and easily decoded.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.848+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3c853132-f85d-4dee-89db-e9b074011e11", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.7, "x": 0.15, "y": 0.44 }, "kind": "paragraph", "text": "The app sending the phone’s IMEI and IMSI to China in plain text, readable XML format.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.848+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e4e6aaee-b421-4199-9cb8-2f8df00595b7", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.6, "x": 0.2, "y": 0.08 }, "kind": "title", "text": "Data being sent to China-based analytics company Talking Data", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:35.848+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7240c564-3022-4c58-8959-dc18fd166b0b", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 36, "type": "appendix", "title": "The slide shows a Wireshark packet capture of unencrypted/encoded traffic followed by a sequence of screenshots showing a malicious app update prompt.", "function": "illustrate_case", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "illustrate_case", "functionCanon": { "name": "Illustrate case", "slug": "illustrate_case", "status": "active", "canonId": "019de52d-13b4-772c-bb73-1873612a7463", "version": 1, "description": null }, "density": "sparse", "densityScore": 17, "componentCount": 5, "textChars": 350, "nDataPoints": 0, "notes": "The slide shows a Wireshark packet capture of unencrypted/encoded traffic followed by a sequence of screenshots showing a malicious app update prompt.", "elementsJson": [ "screenshot", "paragraph" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:37.806+00", "seconds": 4.792, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/36", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-36", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Software engineers simulated a Man in the Middle Attack disguised as a software update to the user's phone.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:53+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc9-be023f3a5883", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.7, "x": 0.15, "y": 0.08 }, "kind": "image", "text": "Wireshark packet capture showing intercepted traffic", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "21122bb6-b499-4f71-8889-adf600683c81", "parentComponentId": null }, { "bbox": { "h": 0.28, "w": 0.7, "x": 0.15, "y": 0.42 }, "kind": "image", "text": "Mobile app update progress and installation prompt", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "33294eee-fb90-495a-ba92-af9f75c33346", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.3, "x": 0.35, "y": 0.38 }, "kind": "paragraph", "text": "Encoded data that is easily hacked", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7d407cb2-ec37-4d35-85d1-f563196b1867", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.76, "x": 0.12, "y": 0.73 }, "kind": "paragraph", "text": "Software engineers simulated a Man in the Middle Attack disguised as a software update to the user's phone.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "99063bd7-b09e-447b-baa4-a7b374669af8", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 37, "type": "tension", "title": "Includes a satirical illustration of a clown carrying a 'USER DATA' briefcase, mocking the company's security claims.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "balanced", "densityScore": 49, "componentCount": 6, "textChars": 1390, "nDataPoints": 2, "notes": "Includes a satirical illustration of a clown carrying a 'USER DATA' briefcase, mocking the company's security claims.", "elementsJson": [ "photo", "paragraph" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:36.881+00", "seconds": 3.847, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/37", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-37", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "NQ's purported $36.5 million on 2012 international revenue is absurd, and to be almost entirely fabricated.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:53+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc9-d3dc628dde67", "parentComponentId": null }, { "bbox": { "h": 0.3, "w": 0.4, "x": 0.3, "y": 0.1 }, "kind": "image", "text": "Clown carrying a briefcase labeled 'USER DATA' with a lock icon.", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Illustration", "slug": "illustration", "status": "active", "canonId": "019de52c-fe76-7772-a5ac-c0b7294d7615", "version": 1, "description": null }, "framework": null }, "subkind": "illustration", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.881+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e017911c-a0ee-4d28-a520-102a6b40798e", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "international revenue: $36.5 million", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:53+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dc9-d70730cfaf07", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.8, "x": 0.1, "y": 0.65 }, "kind": "paragraph", "text": "NQ claims that its ex-China revenue in 2012 was $36.5 million. However, Distimo analytics estimates NQ's year-to-day worldwide revenue at less than $800,000. Distimo is a web analytics company that tracks over 3.2 billion downloads per quarter, and is widely used by web and mobile companies. Distimo tracks downloads from Google Play, the world's largest Android app store; and, Distimo develops estimates for app and developer revenue. The year-to-date chart below shows daily revenue on Google Play for 35 countries. Distimo tracks the following NQ products: Android Booster, Easy Battery Saver, Family Guardian, Easy Finder, Mobile Security, Mobile Security for Retail, Mobile Security 6.0 and Antivirus 7.0, Security Multi-Language, Vulnerability Killer, Super Task Killer and Vault (the Dataset):", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.881+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5eade1d3-aff0-4086-8edf-6551a30f1966", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.8, "x": 0.1, "y": 0.5 }, "kind": "paragraph", "text": "NQ's purported $36.5 million on 2012 international revenue is absurd, and to be almost entirely fabricated. Our conclusion is based on analyses of app downloads, retail site visits, calls with an international carrier, discussions with NQ management, and discussions with industry consultants and NQ competitors.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.881+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7681528c-423d-4ec0-8efd-f2ca7f2b32ed", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.8, "x": 0.1, "y": 0.45 }, "kind": "title", "text": "NQ's International Revenue – Highly Likely to be Massively Overstated", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.881+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "937873c4-2cee-4037-960d-db8def1a5eaa", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "7726abd9-d411-4782-a30d-87f0bbf6125b", "evidence": "The slide explicitly accuses the company of fabricating revenue figures.", "framework": null, "confidence": 1, "extraction": { "at": "2026-05-02 20:51:36.881+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 37, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 38, "type": "analysis", "title": "The slide uses data to cast doubt on NQ's reported revenue and market strength, specifically contrasting US retail presence with reported ARPU.", "function": "analyze_data", "rawType": "appendix_data", "block": null, "metadata": { "slideType": "appendix_data", "slideTypeCanon": { "name": "Appendix data", "slug": "appendix_data", "status": "active", "canonId": "019de52d-078a-745b-9ee4-c15f2f539acd", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "dense", "densityScore": 65, "componentCount": 8, "textChars": 1368, "nDataPoints": 2, "notes": "The slide uses data to cast doubt on NQ's reported revenue and market strength, specifically contrasting US retail presence with reported ARPU.", "elementsJson": [ "line_chart", "paragraph", "footnote" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:36.15+00", "seconds": 3.043, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/38", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-38", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "NQ has its co-headquarters in the US, spends significant sums of money on PR, and yet does not generate meaningful revenue in this market.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:53+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dca-01ca5a8d894b", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.76, "x": 0.12, "y": 0.28 }, "kind": "chart", "text": "Daily downloads chart", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Line chart", "slug": "line", "status": "active", "canonId": "019de52c-ff62-778f-8f6c-a952ceae8677", "version": 1, "description": null }, "framework": null }, "subkind": "line", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.15+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "20bc45e3-167a-4b95-8dc7-01059b65fdd0", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.76, "x": 0.12, "y": 0.09 }, "kind": "chart", "text": "Daily revenue chart", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Line chart", "slug": "line", "status": "active", "canonId": "019de52c-ff62-778f-8f6c-a952ceae8677", "version": 1, "description": null }, "framework": null }, "subkind": "line", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.15+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "923b9935-90e5-4540-bbc9-47f0d577b3c9", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "daily downloads", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:53+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dca-04f6770023b8", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.76, "x": 0.12, "y": 0.56 }, "kind": "paragraph", "text": "NQ has its co-headquarters in the US, spends significant sums of money on PR, and yet does not generate meaningful revenue in this market. (It is not a coincidence that revenue from the US would be much easier to audit than that from developing countries.) Our site visits to 84 retail locations in the US that are supposed to sell NQ products, and conversations with management of some of NQ's US distribution partners yields attachment rates generally of only 2% to 3%. The average ARPU in the US is $46.50.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.15+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "11f68065-0d39-46b0-9b41-b16c457c7b86", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.76, "x": 0.12, "y": 0.69 }, "kind": "paragraph", "text": "The graph below from Distimo data compares the average daily revenue of Lookout, Kaspersky, and NQ, across all mobile security products. We understand that Lookout's worldwide mobile security app revenue is less than $10 million annually.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.15+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "349b394c-c8fb-4f80-b2a9-b4c41c5c4f27", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.76, "x": 0.12, "y": 0.47 }, "kind": "paragraph", "text": "NQ tells investors that its strongest markets are in Southeast Asia and the Middle East – particularly Malaysia, Thailand, Indonesia, and Dubai. It claims an annual ARPU in these markets of $15. The monthly blended ARPU in Thailand is $7.13, with 60% of Thais using a mobile device to access the Internet.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.15+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8639eaf6-1db9-486e-9a3b-72051f2fd44e", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.5, "x": 0.12, "y": 0.88 }, "kind": "source-note", "text": "56 http://www.slideshare.net/yozzo1/2013-thailand-mobile-market-information\n57 http://www.totaltele.com/view.aspx?ID=472089", "attrs": { "numbered": true }, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.15+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6243f5cb-40c8-43f1-a24a-3375d30b38a7", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "550b9806-6cc1-4e07-856f-9b51f21883db", "evidence": "The slide uses data and site visits to challenge the veracity of company claims.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:36.15+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 38, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 39, "type": "tension", "title": "The slide uses investigative research to challenge the company's claims regarding international partnerships and financial efficiency.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "sparse", "densityScore": 18, "componentCount": 5, "textChars": 366, "nDataPoints": 0, "notes": "The slide uses investigative research to challenge the company's claims regarding international partnerships and financial efficiency.", "elementsJson": [ "line_chart", "paragraph" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 21:28:26.765+00", "seconds": 2.21, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/39", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-39", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "None of these industry experts could understand why NQ takes so long to receive payment.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:54+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab0f-015e36aee23e", "parentComponentId": null }, { "bbox": { "h": 0.28, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "chart", "text": "Line chart showing performance trends of NQ, Kaspersky, and Lookout over time.", "attrs": null, "canon": { "kind": { "name": "Chart", "slug": "chart", "status": "active", "canonId": "019de52c-f9a0-76ef-adc6-0b859109d1f8", "version": 1, "description": "Quantitative chart." }, "tool": null, "subkind": { "name": "Line chart", "slug": "line", "status": "active", "canonId": "019de52c-ff62-778f-8f6c-a952ceae8677", "version": 1, "description": null }, "framework": null }, "subkind": "line", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 21:28:26.765+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4e6fa459-bfcf-4a84-bcb4-1ec6e8629137", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "DSO: 198 days", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:54+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab0f-064f0cb18321", "parentComponentId": null }, { "bbox": { "h": 0.62, "w": 0.78, "x": 0.11, "y": 0.31 }, "kind": "paragraph", "text": "Analysis of mobile security markets, conversion rates, payment collection delays (DSOs), and skepticism regarding NQ's partnership announcements and user acquisition costs.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 21:28:26.765+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ec8559cb-d4b4-47d3-affd-dc9ca1ac83f6", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.12, "x": 0.44, "y": 0.28 }, "kind": "source-note", "text": "Source: Distimo", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 21:28:26.765+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c0b51356-62d7-4c13-86d0-fe925769155e", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "c9ee2f2f-be4f-4eed-aca7-2263c5a5b66e", "evidence": "The slide systematically challenges company claims regarding revenue, DSOs, and acquisition costs.", "framework": null, "confidence": 0.85, "extraction": { "at": "2026-05-02 21:28:26.765+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 39, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 40, "type": "tension", "title": "This slide serves as a critical assessment of NQ Mobile's business model and market positioning.", "function": "name_villain", "rawType": "villain_critique", "block": null, "metadata": { "slideType": "villain_critique", "slideTypeCanon": { "name": "Villain critique", "slug": "villain_critique", "status": "active", "canonId": "019de52d-10bc-7136-bf20-09de59d17447", "version": 1, "description": null }, "function": "name_villain", "functionCanon": { "name": "Name villain", "slug": "name_villain", "status": "active", "canonId": "019de52d-1746-70d6-bc58-5eeaf5865526", "version": 1, "description": null }, "density": "dense", "densityScore": 67, "componentCount": 8, "textChars": 1448, "nDataPoints": 4, "notes": "This slide serves as a critical assessment of NQ Mobile's business model and market positioning.", "elementsJson": [ "paragraph" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:40.58+00", "seconds": 6.864, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/40", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-40", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "The mobile security app market is much harder than NQ makes it appear", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:53+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dca-1ef9fc6f7806", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.8, "x": 0.1, "y": 0.42 }, "kind": "paragraph", "text": "The mobile antivirus and security revenue constitutes a negligible segment of the overall antivirus software market. Desktop antivirus companies offer a mobile product for competitive reasons, often at a loss, to lock their customers into a multi-device solution.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:40.58+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1bf2e9f7-0e6f-445b-b45d-7fc0005a8d88", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.8, "x": 0.1, "y": 0.1 }, "kind": "paragraph", "text": "this service free to any developer willing to adhere to its ethical policy. There are approximately 3,000 developers using Blue Via, and we understand that Telefonica has never terminated any relationship. There is no minimum sales requirement to be on the platform.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:40.58+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2f664ae4-56bb-4a2e-87a3-fb548a2b467d", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.8, "x": 0.1, "y": 0.7 }, "kind": "paragraph", "text": "NQ’s lack of a desktop product creates a disadvantage when it comes to retail sales and the sales person upon whom they must rely has a store full of products to sell, most of which can be sold quickly.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:40.58+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5a27bffd-fcb7-42e9-ad36-5e8d6b365483", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.8, "x": 0.1, "y": 0.53 }, "kind": "paragraph", "text": "The US retail channel is not well-suited to mobile security app developers. Retail is a difficult sales channel to penetrate considering stores want 30% to 40% of gross revenue. Stores require collateral and sales person training.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:40.58+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7be8b401-d13b-4ae7-8c17-721bb36000c1", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.8, "x": 0.1, "y": 0.25 }, "kind": "paragraph", "text": "One of our consultants with knowledge of Blue Via said, “There have not been many downloads of NQ software. Just a few. It’s not a big business.” Telefonica’s mobile security vendor of choice in Brazil is F-Secure, not NQ.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:40.58+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a8b8c041-5c50-4ddf-b40a-4e561645a63b", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "There have not been many downloads of NQ software. Just a few. It’s not a big business. — Consultant with knowledge of Blue Via", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:53+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dca-231e90086b53", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.8, "x": 0.1, "y": 0.38 }, "kind": "title", "text": "The mobile security app market is much harder than NQ makes it appear", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Action title", "slug": "action-title", "status": "active", "canonId": "019de52c-fb31-734c-a0f5-a3935b73135d", "version": 1, "description": null }, "framework": null }, "subkind": "action-title", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:40.58+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6586b45f-4e7c-49a6-b4ab-1c325e45d551", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Villain slide", "slug": "villain-slide", "status": "active", "bestFor": "In activist decks where the personality matters", "canonId": "019dd9e1-518c-7404-976a-5be5a517b659", "version": 1, "bodyDocId": null, "description": "A dedicated slide presenting the named villain visually", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "41a236e8-8642-4467-818f-96a6eea98de1", "evidence": "The mobile security app market is much harder than NQ makes it appear (title matches villain_critique slide type)", "pageRefs": null, "priority": null, "whenToUse": "In activist decks where the personality matters", "confidence": 0.9, "extraction": { "at": "2026-07-16 22:57:39.248943+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 40, "whyItWorks": "Makes the antagonist concrete", "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 41, "type": "tension", "title": "The slide uses anecdotal evidence and visual proof to undermine the credibility of the company's operations.", "function": "name_villain", "rawType": "villain_critique", "block": null, "metadata": { "slideType": "villain_critique", "slideTypeCanon": { "name": "Villain critique", "slug": "villain_critique", "status": "active", "canonId": "019de52d-10bc-7136-bf20-09de59d17447", "version": 1, "description": null }, "function": "name_villain", "functionCanon": { "name": "Name villain", "slug": "name_villain", "status": "active", "canonId": "019de52d-1746-70d6-bc58-5eeaf5865526", "version": 1, "description": null }, "density": "dense", "densityScore": 51, "componentCount": 8, "textChars": 735, "nDataPoints": 1, "notes": "The slide uses anecdotal evidence and visual proof to undermine the credibility of the company's operations.", "elementsJson": [ "headline_text", "paragraph", "photo" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:41.697+00", "seconds": 7.967, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/41", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-41", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "NQ should produce Breakin' 3 Don't Crash Into a Tree and do product placement.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:54+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab0e-ed3af51fc915", "parentComponentId": null }, { "bbox": { "h": 0.41, "w": 0.32, "x": 0.118, "y": 0.359 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Photo", "slug": "photo", "status": "active", "canonId": "019de52c-fd37-757f-b4a8-ca26d4888875", "version": 1, "description": null }, "framework": null }, "subkind": "photo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.697+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "292241b6-0804-4374-9023-cac710fd13bc", "parentComponentId": null }, { "bbox": { "h": 0.41, "w": 0.354, "x": 0.528, "y": 0.359 }, "kind": "image", "text": null, "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Photo", "slug": "photo", "status": "active", "canonId": "019de52c-fd37-757f-b4a8-ca26d4888875", "version": 1, "description": null }, "framework": null }, "subkind": "photo", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.697+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3b9d846c-e4fa-4ca5-ab47-17ea342eff7d", "parentComponentId": null }, { "bbox": { "h": 0.195, "w": 0.764, "x": 0.118, "y": 0.135 }, "kind": "paragraph", "text": "The farcical facts we uncovered about NQ sometimes made it easy to forget that the Company is committing a very serious fraud. Such chicanery is not unusual in the China fraud context...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.697+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3f1de4d1-416e-44d2-aa80-942178b15693", "parentComponentId": null }, { "bbox": { "h": 0.045, "w": 0.764, "x": 0.118, "y": 0.873 }, "kind": "paragraph", "text": "Card buyers need to download software to operate the anonymous card. The two vendors told us that the URL on the anonymous card, http.KD.tl (.tl is an East Timor domain.), is the site from", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.697+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8a55be15-b6eb-4aee-94a0-489bdc889d90", "parentComponentId": null }, { "bbox": { "h": 0.115, "w": 0.764, "x": 0.118, "y": 0.736 }, "kind": "paragraph", "text": "NQ's anonymous calling card business is silly. China now requires an ID to buy prepaid cards. Anonymous calling cards are relatively rare in China, and are not condoned by the authorities.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.697+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b51017ca-454c-4b0e-b30c-95fbf1f6a69b", "parentComponentId": null }, { "bbox": { "h": 0.035, "w": 0.354, "x": 0.528, "y": 0.657 }, "kind": "source-note", "text": "NQ should produce Breakin' 3 Don't Crash Into a Tree and do product placement.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.697+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8577eb30-a5fa-4961-837a-77e326cd3033", "parentComponentId": null }, { "bbox": { "h": 0.022, "w": 0.175, "x": 0.118, "y": 0.098 }, "kind": "title", "text": "The Farcical Side", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.697+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "02781209-80cd-41d3-9d80-4a7c9840a2e7", "parentComponentId": null } ], "metrics": [], "tools": [ { "tool": { "name": "Villain slide", "slug": "villain-slide", "status": "active", "bestFor": "In activist decks where the personality matters", "canonId": "019dd9e1-518c-7404-976a-5be5a517b659", "version": 1, "bodyDocId": null, "description": "A dedicated slide presenting the named villain visually", "familyLabel": null, "categoryName": null, "categorySlug": null }, "agent": null, "layer": "slide", "agents": null, "matchId": "e1143ceb-1b5a-47ac-8222-3b28dd3c15f1", "evidence": "The Farcical Side (title matches villain_critique slide type)", "pageRefs": null, "priority": null, "whenToUse": "In activist decks where the personality matters", "confidence": 0.9, "extraction": { "at": "2026-07-16 22:57:39.331831+00", "model": "or:meta-llama/llama-4-scout", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 41, "whyItWorks": "Makes the antagonist concrete", "antipattern": null, "cardinality": null, "narrativePurpose": null } ], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 42, "type": "tension", "title": "This is a text-heavy research note page documenting investigative findings regarding NQ Mobile's business practices.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 85, "componentCount": 10, "textChars": 2538, "nDataPoints": 1, "notes": "This is a text-heavy research note page documenting investigative findings regarding NQ Mobile's business practices.", "elementsJson": [ "paragraph", "numbered_list", "footnote" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:44.744+00", "seconds": 10.976, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/42", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-42", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "This black hat stunt would be far less likely to happen at a real company.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:54+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dca-7fc986e1b35c", "parentComponentId": null }, { "bbox": { "h": 0.115, "w": 0.25, "x": 0.147, "y": 0.445 }, "kind": "list", "text": "1. NOKIAsecure.com\n2. NTTsecurity.com\n3. SAMSUNGsecure.com\n4. securityHTC.com\n5. securityIPHONE.com\n6. VODAFONEsecurity.com", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Numbered list", "slug": "numbered", "status": "active", "canonId": "019de52c-fcc0-7718-a284-a4250c805df2", "version": 1, "description": null }, "framework": null }, "subkind": "numbered", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:44.744+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "506e05a7-38ac-460b-ae6e-8adbbe35c4e3", "parentComponentId": null }, { "bbox": { "h": 0.135, "w": 0.772, "x": 0.118, "y": 0.713 }, "kind": "paragraph", "text": "Pimpin’ sure gets a lot easier with NQ for Men.58 NQ for Men appears to be a mobile phone app that keeps significant others from being able to see the “black book” part of the contacts, call / SMS history to black book contacts, and blocks calls and SMSes from these contacts during inconvenient times. MW acknowledges that there is likely a niche market for this product, but we are not sure it is something with which a global leader in mobile security would be involved. Note to Anthony Weiner: read the section titled NQ’s Antivirus Makes it Easy for the PRC Government and Hackers… before using.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:44.744+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "29588e6b-329f-434e-b1dc-90004888cf2b", "parentComponentId": null }, { "bbox": { "h": 0.052, "w": 0.772, "x": 0.118, "y": 0.238 }, "kind": "paragraph", "text": "NQ is behind the anonymous calling cards. The software used references NQ, and a website through which the software operates http://secretclothes.com, lists NQ’s webmaster, Zhang Guobao, as the contact.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:44.744+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "329b66c2-2961-4cc4-8c91-4aa5f2c040ab", "parentComponentId": null }, { "bbox": { "h": 0.135, "w": 0.772, "x": 0.118, "y": 0.094 }, "kind": "paragraph", "text": "which to download the software. (NQ has an affinity for two-letter domains – as we highlight infra, it claims to have paid $1.55 million to an anonymous party for 10-year rights to www.nq.com.) Similar to how NQ has responded to our prepaid card inquiries, it suddenly removed all content from the website on October 18th. The Beijing vendor also changed his story about the cards on October 18th – as we discussed supra, we rattled NQ’s cage with our prepaid card queries.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:44.744+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9aefbb5e-a389-461b-817d-3f15daf3324a", "parentComponentId": null }, { "bbox": { "h": 0.025, "w": 0.35, "x": 0.118, "y": 0.571 }, "kind": "paragraph", "text": "All of these domains redirect to en.NQ.com.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:44.744+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "adb7d42a-8e10-4c44-b41b-8c130e9ae996", "parentComponentId": null }, { "bbox": { "h": 0.085, "w": 0.772, "x": 0.118, "y": 0.612 }, "kind": "paragraph", "text": "We would be surprised if these companies licensed their trademarks to NQ for this purpose – particularly in the case of Samsung, which has a similar URL for its security equipment division (www.samsungsecurity.com). We have already sent letters to the general counsel for each of these companies. This black hat stunt would be far less likely to happen at a real company.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:44.744+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b1257b3e-c23a-4353-bf2e-f62ae3b84daa", "parentComponentId": null }, { "bbox": { "h": 0.135, "w": 0.772, "x": 0.118, "y": 0.301 }, "kind": "paragraph", "text": "NQ’s is likely infringing the trademarks of Samsung, Nokia, HTC, NTT, Vodaphone, and Apple. NQ is engaged in “black hat SEO” by registering URLs with these trademarks in them, and pointing them toward NQ’s US website. On October 21, 2013 we ran a Reverse IP lookup on NQ’s website, www.netqin.com, located at 211.151.59.30. These servers host domains that include expected regional variations of the NQ brand such as NQ.fr, NQ.jp. However, these servers also host domains with the following trademarks in the URL:", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:44.744+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e474208b-66ca-4772-ab09-0a46be0f4c00", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "“Pimpin’ Ain’t Easy”, Big Daddy Kane, It’s a Big Daddy Thing (1989).", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:54+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dca-80a33e3ce397", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.45, "x": 0.118, "y": 0.905 }, "kind": "source-note", "text": "58 “Pimpin’ Ain’t Easy”, Big Daddy Kane, It’s a Big Daddy Thing (1989).", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:44.744+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "fb6c48cb-fcda-4551-a925-0b9792610353", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 43, "type": "tension", "title": "The text argues that the domain purchase was likely a related-party transaction or a fabrication to inflate cash figures.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "sparse", "densityScore": 14, "componentCount": 3, "textChars": 327, "nDataPoints": 1, "notes": "The text argues that the domain purchase was likely a related-party transaction or a fabrication to inflate cash figures.", "elementsJson": [ "screenshot", "paragraph" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:38.718+00", "seconds": 4.693, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/43", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-43", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "NQ's claim to have paid $1.55 million for the domain www.nq.com is outrageous.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:54+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dca-4abf89fbbcfa", "parentComponentId": null }, { "bbox": { "h": 0.45, "w": 0.7, "x": 0.15, "y": 0.08 }, "kind": "image", "text": "App store page for NQ for Men", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.718+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b6423e5a-9ce2-49ca-a20e-4cee999b7ec8", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.76, "x": 0.12, "y": 0.68 }, "kind": "paragraph", "text": "NQ's claim to have paid $1.55 million for the domain www.nq.com is outrageous. NQ claims to have paid the money in July 2011, but the curious thing is that the domain was transferred to an anonymous registrant in 2011...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.718+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "784bf2f3-9848-46c5-abee-ffa81d22abdf", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "da09f4a3-082a-4163-9580-048cb87b492d", "evidence": "The text explicitly questions the legitimacy of a financial transaction to suggest potential fraud.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:38.718+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 43, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 44, "type": "tension", "title": "The slide uses evidence from the application's code and UI to demonstrate deceptive practices.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "sparse", "densityScore": 20, "componentCount": 5, "textChars": 531, "nDataPoints": 0, "notes": "The slide uses evidence from the application's code and UI to demonstrate deceptive practices.", "elementsJson": [ "paragraph", "screenshot", "other" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:36.983+00", "seconds": 2.94, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/44", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-44", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "NQ is “scare ware” – NQ Antivirus 7.0 is hardcoded to tell the user the NQ discovered two viruses the same day the user installs the app.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:54+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dca-312f36dad089", "parentComponentId": null }, { "bbox": { "h": 0.65, "w": 0.285, "x": 0.356, "y": 0.285 }, "kind": "image", "text": "Screenshot of NQ Antivirus UI showing fake virus discovery dates.", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.983+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "19714dde-b206-4c53-9930-5b5bf3db1e96", "parentComponentId": null }, { "bbox": { "h": 0.085, "w": 0.765, "x": 0.118, "y": 0.725 }, "kind": "image", "text": "Code snippet showing hardcoded virus strings.", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.983+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2b14ca13-e837-4709-9d9b-5e93a694e512", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.16 }, "kind": "paragraph", "text": "NQ is “scare ware” – NQ Antivirus 7.0 is hardcoded to tell the user the NQ discovered two viruses the same day the user installs the app.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.983+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3dc6516b-b9ca-4fb9-b574-02e3222dabe3", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.78, "x": 0.11, "y": 0.68 }, "kind": "paragraph", "text": "When we examine the code, we can see that these virus alerts are actually hardcoded into the application, and are presented to the user by default:", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.983+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b7fc4ebe-baae-40a1-9608-02b68a8f6d53", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "a2d7d976-d1bb-4682-a205-17b738fb3210", "evidence": "The slide explicitly exposes deceptive 'scareware' practices by comparing UI claims to hardcoded source code.", "framework": null, "confidence": 0.95, "extraction": { "at": "2026-05-02 20:51:36.983+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 44, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 45, "type": "tension", "title": "The slide uses screenshots of search results to show how NQ Mobile's press releases were blindly republished, contrasting this with the actual investigative fin", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "balanced", "densityScore": 45, "componentCount": 7, "textChars": 982, "nDataPoints": 0, "notes": "The slide uses screenshots of search results to show how NQ Mobile's press releases were blindly republished, contrasting this with the actual investigative findings of the '3-15 incident'.", "elementsJson": [ "paragraph", "screenshot" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:39.994+00", "seconds": 5.859, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/45", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-45", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "NQ broke the cardinal rule of China fraud: Do not get into trouble in China.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:54+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0935-737e-8dca-6a416cb6a4fe", "parentComponentId": null }, { "bbox": { "h": 0.38, "w": 0.78, "x": 0.11, "y": 0.14 }, "kind": "image", "text": "Screenshots of Google search results and a Globe Investor news article showing NQ Mobile press releases.", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:39.994+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bcc0b15e-bd06-466d-9c44-6bd7d39798e7", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.78, "x": 0.11, "y": 0.72 }, "kind": "paragraph", "text": "CCTV revealed that NQ and its subsidiary, FL Mobile, were paying phone refurbishers in China to install both NQ and FL software. However, the FL software was really a trojan...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:39.994+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "05529cc8-b805-40ae-85c8-fa24bd94c39a", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.78, "x": 0.11, "y": 0.86 }, "kind": "paragraph", "text": "The exposure was a massive problem, and threatened to derail NQ's fraud dreams. Its IPO was postponed by a few months while it tried to paper over the bad publicity.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:39.994+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5ed68553-d75f-427c-bb80-d602acd02ba6", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "paragraph", "text": "We did not find anyone who has been infected. What we did find were multiple websites that mindlessly regurgitate NQ press releases put out through PR Newswire service:", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:39.994+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "99be80ca-c560-474a-a77d-7bce02d8560a", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.62 }, "kind": "paragraph", "text": "NQ broke the cardinal rule of China fraud: Do not get into trouble in China. State-owned CCTV, the most influential television news network in China, exposed some of NQ's dishonest practices in what is known as the “3-15 incident”.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:39.994+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a0259327-609c-457c-becf-e58992ba226b", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.78, "x": 0.11, "y": 0.58 }, "kind": "title", "text": "NQ's 3-15 DNA – Video Available at: https://vimeo.com/77704496", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:39.994+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "210cb161-42eb-471c-bdd4-b760b96e0e46", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 46, "type": "tension", "title": "This is a text-heavy research note page detailing specific instances of corporate malfeasance.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 87, "componentCount": 12, "textChars": 2930, "nDataPoints": 0, "notes": "This is a text-heavy research note page detailing specific instances of corporate malfeasance.", "elementsJson": [ "paragraph" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:44.06+00", "seconds": 9.817, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/46", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-46", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "3-15 is important for investors to understand NQ's management. First, they obviously lack an ethical compass - that is the obvious. More subtly though, this is evidence that they just cannot help themselves.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:55+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab0f-2d52ab6bdfe3", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.882, "x": 0.11, "y": 0.518 }, "kind": "paragraph", "text": "NQ tried to paper over its wrongdoing by submitting code to be certified as clean. Obviously NQ submitted the OTHER code - i.e., the code without the malware.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:44.06+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1292abeb-2308-4538-9e7f-813b9d9bc8c6", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.882, "x": 0.11, "y": 0.568 }, "kind": "paragraph", "text": "We have posted the 3-15 video on our website with subtitles. We believe that investors will find it illuminating. The video is at: https://vimeo.com/77704496.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:44.06+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1def073b-afdf-4dd5-b39f-822354347903", "parentComponentId": null }, { "bbox": { "h": 0.045, "w": 0.882, "x": 0.11, "y": 0.094 }, "kind": "paragraph", "text": "former NQ employee who joined the Company after the 3-15 incident. She informed us that NQ tells employees that CCTV the following year aired a retraction. We viewed the 2012 program, and there was no retraction of any sort. This appears to be a lie.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:44.06+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "23566e39-530e-481b-aaf8-fa5516a8c051", "parentComponentId": null }, { "bbox": { "h": 0.075, "w": 0.882, "x": 0.11, "y": 0.328 }, "kind": "paragraph", "text": "The issue addressed in their statement was primarily that of the \"version problem\" followed by the \"key\" problems, and even went so far as to claim that they were framed by their competitors. All so-called \"great\" companies claim they were framed by competitors when they are exposed. Would CCTV's 3-15 Gala show do such a thing? Now the two companies have removed their statements, both having already admitted their mistakes.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:44.06+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "64bb68ca-4716-428e-a2eb-4f7b086c85cf", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.821, "x": 0.17, "y": 0.278 }, "kind": "paragraph", "text": "Yin Wen: the content of Feiliu JiuTian's statement really has no substance, they did not state what specific points were mistaken.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:44.06+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7582791a-74e1-4512-bf38-7267dd8a7c02", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.821, "x": 0.17, "y": 0.228 }, "kind": "paragraph", "text": "China Times: The day after the report exposing NetQin and Feiliu Jiu Tian of jointly harming consumers, they declared there were serious discrepancies with your facts.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:44.06+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "95fb052e-d266-4532-8424-d7d0f48f00a9", "parentComponentId": null }, { "bbox": { "h": 0.075, "w": 0.882, "x": 0.11, "y": 0.618 }, "kind": "paragraph", "text": "3-15 is important for investors to understand NQ's management. First, they obviously lack an ethical compass - that is the obvious. More subtly though, this is evidence that they just cannot help themselves. Scamming consumers for RMB 2 a pop was clearly a stupid risk given the hundreds of millions of dollars they could pocket through a successful stock fraud. These are people who will steal the shirts off investors' backs - without hesitating.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:44.06+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "971885ea-5645-4ade-828f-cf58b408ab78", "parentComponentId": null }, { "bbox": { "h": 0.075, "w": 0.882, "x": 0.11, "y": 0.423 }, "kind": "paragraph", "text": "In fact, the purpose of this program is to provide consumers with a clue. Although the program was only a few minutes long, in fact, we started the investigation of these two companies in October of last year and spent a total of four months of time investigating. In total we spent four months tracking them, determining how they did the downloads, assessing how they control users, all of this have been investigated very clearly.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:44.06+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a7a4732a-b61e-492d-8d5e-134c04b64a3c", "parentComponentId": null }, { "bbox": { "h": 0.045, "w": 0.882, "x": 0.11, "y": 0.163 }, "kind": "paragraph", "text": "NQ tells investors that CCTV privately retracted its reporting. We see no evidence of the sort. We did come across an interview with the director of that episode in which the director reiterated that NQ and FL were culpable:", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:44.06+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e5f3f709-ff38-4474-8c97-538297dba6f2", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "China Times: The day after the report exposing NetQin and Feiliu Jiu Tian of jointly harming consumers, they declared there were serious discrepancies with your facts. Yin Wen: the content of Feiliu JiuTian's statement really has no substance, they did not state what specific points were mistaken.", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:55+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab0f-3365e739528f", "parentComponentId": null }, { "bbox": { "h": 0.024, "w": 0.488, "x": 0.11, "y": 0.848 }, "kind": "title", "text": "US Management is Merely a Front", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:44.06+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "20f47870-6fe5-4a2e-ad25-efb3ef6e4b38", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "4416af2b-9b7c-42f9-90d1-19ce5741a202", "evidence": "The slide systematically lists evidence of corporate deception and fraud to discredit management.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:44.06+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 46, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 47, "type": "appendix", "title": "The slide uses a narrative structure to expose the mechanics of a corporate fraud scheme, specifically focusing on the role of a 'front' executive.", "function": "expose_contradiction", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "sparse", "densityScore": 13, "componentCount": 3, "textChars": 256, "nDataPoints": 2, "notes": "The slide uses a narrative structure to expose the mechanics of a corporate fraud scheme, specifically focusing on the role of a 'front' executive.", "elementsJson": [ "paragraph", "footnote" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:37.013+00", "seconds": 2.674, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/47", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-47", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "NQ would have viewed Omar Khan as the perfect front for its fraud.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:54+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab0f-181243dbfd25", "parentComponentId": null }, { "bbox": { "h": 0.8, "w": 0.8, "x": 0.1, "y": 0.1 }, "kind": "paragraph", "text": "NQ would have viewed Omar Khan as the perfect front for its fraud. That is why it offered him a pay package worth over approximately $20 million during the first three years...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.013+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e4b1f4f9-a7bb-4d91-bdd7-0c5d88732a69", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.1, "x": 0.1, "y": 0.9 }, "kind": "source-note", "text": "59 SAIC files.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.013+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "187de5c2-c716-4f2e-afd7-0b79cd9823bd", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "d43f4241-ab6e-4658-b2ae-833c405a2a5f", "evidence": "The text explicitly details the mechanics of 'China Fraud 1.0' vs '2.0' and the role of a front man.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:37.013+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 47, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 48, "type": "tension", "title": "The text discusses the 'China Fraud' ecosystem, specifically referencing Longtop Financial Technologies (LFT) and the complicity of auditors and bank employees.", "function": "name_villain", "rawType": "villain_critique", "block": null, "metadata": { "slideType": "villain_critique", "slideTypeCanon": { "name": "Villain critique", "slug": "villain_critique", "status": "active", "canonId": "019de52d-10bc-7136-bf20-09de59d17447", "version": 1, "description": null }, "function": "name_villain", "functionCanon": { "name": "Name villain", "slug": "name_villain", "status": "active", "canonId": "019de52d-1746-70d6-bc58-5eeaf5865526", "version": 1, "description": null }, "density": "dense", "densityScore": 52, "componentCount": 7, "textChars": 1126, "nDataPoints": 2, "notes": "The text discusses the 'China Fraud' ecosystem, specifically referencing Longtop Financial Technologies (LFT) and the complicity of auditors and bank employees.", "elementsJson": [ "paragraph", "footnote" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:38.317+00", "seconds": 3.768, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/48", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-48", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "We strongly suspect that the vast majority of the $127.9 million cash and investments NQ reported having as of December 31, 2012 is not actually in the Company's accounts; rather, that some to all of NQ's IPO proceeds have been diverted in order to further the accounting fraud.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:55+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab10-41e2f9c2a11b", "parentComponentId": null }, { "bbox": { "h": 0.21, "w": 0.764, "x": 0.118, "y": 0.303 }, "kind": "paragraph", "text": "NQ's current and former CFO are old hands in the China Fraud world. We do not suspect that they were ever culpable in the frauds with which they have been involved...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.317+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0f7b025d-be88-489f-be74-c83e8f2a6bfb", "parentComponentId": null }, { "bbox": { "h": 0.18, "w": 0.764, "x": 0.118, "y": 0.094 }, "kind": "paragraph", "text": "LFT) was confirmed as a fraud, numerous very China savvy investors were stunned. We recall conversations with some of these investors, and their shock was due to their faith in LFT CFO Derek Palaschuk...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.317+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "24a07c6d-2067-415f-8a01-8e6d77d25eb1", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.764, "x": 0.118, "y": 0.583 }, "kind": "paragraph", "text": "We strongly suspect that the vast majority of the $127.9 million cash and investments NQ reported having as of December 31, 2012 is not actually in the Company's accounts...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.317+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8374f9cb-17a3-407b-8d10-7fb9c35c5004", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.764, "x": 0.118, "y": 0.715 }, "kind": "paragraph", "text": "Forging cash balances in China is shockingly common and easy. Unfortunately, cash balance confirmation is the only anti-fraud procedure most public company audits incorporate...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.317+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f974655f-d853-47fc-a3ee-8e5853e78286", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.38, "x": 0.118, "y": 0.87 }, "kind": "source-note", "text": "60 2012 20F, p. F-23. 61 See Longtop 6-K filed May 23, 2011.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.317+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ab7fb003-93f2-4207-bb11-3f4122297f09", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.764, "x": 0.118, "y": 0.548 }, "kind": "title", "text": "NQ's Cash Balance (a Level 2 Asset) is Highly Likely to be Fraudulent", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.317+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ddb1e4f3-fa9a-4045-87d4-a24ce6214c57", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "964f5012-5f17-476b-9fa5-5eab4e5572f5", "evidence": "The slide explicitly details the mechanisms of financial fraud and identifies specific red flags in NQ's accounting.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:38.317+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 48, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 49, "type": "tension", "title": "The slide highlights a suspicious reclassification of cash assets from Level 1 (quoted prices) to Level 2 (observable inputs) without explanation, suggesting po", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "balanced", "densityScore": 36, "componentCount": 6, "textChars": 594, "nDataPoints": 24, "notes": "The slide highlights a suspicious reclassification of cash assets from Level 1 (quoted prices) to Level 2 (observable inputs) without explanation, suggesting potential fraud.", "elementsJson": [ "paragraph", "data_table", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:38.288+00", "seconds": 3.678, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/49", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-49", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "The Level 2 reclassification raises worrying issues because the default assumption is that cash and term deposits of less than 12 months in safe banks are not Level 2 assets.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:56+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab10-6c7f4d40b6d6", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Fair value measurement: $127,938", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:56+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab10-72dad015070d", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.764, "x": 0.118, "y": 0.145 }, "kind": "paragraph", "text": "The first warning sign about NQ's purported cash balance being fraudulent is that in the 2012 20-F, NQ classified all cash and equivalents, and term deposits, as Level 2 assets for 2011 and 2012.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.288+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ace71ff7-0bc8-4924-90e8-f88813fea0f7", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.25, "x": 0.118, "y": 0.88 }, "kind": "source-note", "text": "62 2012 20F, p. F-23. 63 2011 20F, p. F-18.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.288+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "57ceb972-6950-4d1b-8825-59db415fe129", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.764, "x": 0.118, "y": 0.685 }, "kind": "table", "text": "2011 20-F schedule showing 2010 and 2011 assets classified as Level 1.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.288+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "afcce9f1-ecec-439e-a32c-181813f3e1e9", "parentComponentId": null }, { "bbox": { "h": 0.22, "w": 0.764, "x": 0.118, "y": 0.405 }, "kind": "table", "text": "2012 and 2011 fair value measurement tables showing reclassification to Level 2.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.288+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bcfc4b3f-c48c-47b0-8461-4bc4c2f7e65d", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "3b6e62b3-232d-4e64-b754-571fd53b7384", "evidence": "The slide explicitly identifies 'warning signs' of fraudulent cash balances through accounting inconsistencies.", "framework": null, "confidence": 0.95, "extraction": { "at": "2026-05-02 20:51:38.288+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 49, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 50, "type": "tension", "title": "The slide uses a corporate structure diagram to illustrate the complexity and potential for fund diversion in VIE structures.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "balanced", "densityScore": 37, "componentCount": 5, "textChars": 1064, "nDataPoints": 2, "notes": "The slide uses a corporate structure diagram to illustrate the complexity and potential for fund diversion in VIE structures.", "elementsJson": [ "paragraph", "process_diagram" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:37.699+00", "seconds": 2.876, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/50", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-50", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Our view is that most to all of the cash transfer never happened, and that by purporting to have somehow circumvented China's capital controls in order to transfer the money directly to the VIE, it makes it easier for NQ to carry out its fraud by forging its cash balances.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:55+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab0f-6f8a4dc7327e", "parentComponentId": null }, { "bbox": { "h": 0.35, "w": 0.7, "x": 0.15, "y": 0.45 }, "kind": "diagram", "text": "Corporate structure diagram showing offshore and PRC entities connected by ownership and contractual arrangements.", "attrs": null, "canon": { "kind": { "name": "Diagram", "slug": "diagram", "status": "active", "canonId": "019de52c-f9f0-734a-81de-15382ff28c65", "version": 1, "description": "Schematic or relational diagram." }, "tool": null, "subkind": { "name": "Org chart", "slug": "org-chart", "status": "active", "canonId": "019de52d-04b3-709a-9328-bbcb1643bbc1", "version": 1, "description": null }, "framework": null }, "subkind": "org-chart", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.699+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "63a3de00-214e-4da3-947d-a005455b521c", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.8, "x": 0.1, "y": 0.09 }, "kind": "paragraph", "text": "One therefore wonders what NQ is showing its auditors as evidence of the existence of the cash and the term deposits, and why the auditor deemed it necessary to reclassify 2011 cash and term deposits.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.699+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "22bb6d90-866c-4c88-bc0c-1e08a97f2469", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.8, "x": 0.1, "y": 0.83 }, "kind": "paragraph", "text": "The proper way to move money into the PRC is by downstreaming cash from NQ Hong Kong to NQ Beijing. This may be in either the form of registered capital increase or a loan. NQ did this with $20 million in January 2012.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.699+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "64770186-9ef7-43cb-be26-2b56b43df9dc", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.8, "x": 0.1, "y": 0.18 }, "kind": "paragraph", "text": "NQ's purported implausible movement of funds makes it easier to divert funds without detection. When analyzing NQ's SEC filings alongside its (fraudulent) SAIC financials, it becomes clear that NQ purports to have moved $47 million of IPO proceeds to its VIE.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.699+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "973e7667-3830-4ce3-83ae-b6de113f127f", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "8d1f91d3-3560-4e95-855b-1b1ba19b0a89", "evidence": "The slide explicitly argues that the company's financial movements are implausible and indicative of fraud.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:37.699+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 50, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 51, "type": "tension", "title": "The slide uses forensic accounting logic to challenge the legitimacy of reported cash movements between the WFOE and VIE.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "dense", "densityScore": 59, "componentCount": 8, "textChars": 917, "nDataPoints": 12, "notes": "The slide uses forensic accounting logic to challenge the legitimacy of reported cash movements between the WFOE and VIE.", "elementsJson": [ "paragraph", "data_table", "footnote" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:38.796+00", "seconds": 3.827, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/51", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-51", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "It is almost inconceivable that NQ would have been able to execute the purported transaction.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:55+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab0f-4343a12bd4c1", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.78, "x": 0.11, "y": 0.33 }, "kind": "paragraph", "text": "As you can see below, the VIE entities lost $3.8 million in 2011. Yet, cash at the VIE increased by $66 million...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.796+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "823193e9-61c5-43b4-a391-1d0afae17956", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "paragraph", "text": "NQ Beijing via a registered capital increase... NQ would have a much greater ability to commit fraud.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.796+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d5226fa9-dde1-48c3-95a9-6ad90e05c373", "parentComponentId": null }, { "bbox": { "h": 0.18, "w": 0.78, "x": 0.11, "y": 0.61 }, "kind": "paragraph", "text": "It is almost inconceivable that NQ would have been able to execute the purported transaction. Because the VIE is owned by PRC nationals...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.796+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "dfb31c22-2031-4109-b1bf-fbbbb4bf7836", "parentComponentId": null }, { "bbox": { "h": 0.07, "w": 0.78, "x": 0.11, "y": 0.25 }, "kind": "paragraph", "text": "NQ's SEC disclosures and SAIC financials make clear that it is purporting to have loaned IPO dollars directly to the VIE...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.796+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ea5405b5-25dc-432e-8099-95a48a56bde3", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "An attorney from a leading PRC law firm that is highly experienced in working with VIEs said that he and his partners had never seen any private — Anonymous Attorney", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:55+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab0f-47a82429055c", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.78, "x": 0.11, "y": 0.82 }, "kind": "source-note", "text": "Footnotes 64-67 detailing SAIC files, SEC filings, and PRC regulations.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.796+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c8fd6914-ea90-4f86-b27b-5f7e8bcd46ea", "parentComponentId": null }, { "bbox": { "h": 0.11, "w": 0.36, "x": 0.53, "y": 0.48 }, "kind": "table", "text": "Financial table showing Total net revenue, Net income/(loss), and Net increase/(decrease) in cash for 2010-2012.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.796+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e6189637-e970-42e4-ac34-520b22932168", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "6e022f8a-2c36-4ae3-b82f-8e8b26ca2bfd", "evidence": "The slide explicitly argues that the company's financial narrative is inconsistent with regulatory reality to suggest fraud.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:38.796+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 51, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 52, "type": "setup", "title": "This appears to be a continuation of a sentence from a previous page.", "function": "filler", "rawType": "filler", "block": null, "metadata": { "slideType": "filler", "slideTypeCanon": { "name": "Filler", "slug": "filler", "status": "active", "canonId": "019de52d-0829-76f9-9abe-4c11ee7bf4ab", "version": 1, "description": null }, "function": "filler", "functionCanon": { "name": "Filler", "slug": "filler", "status": "active", "canonId": "019de52d-1568-702b-ad12-428490978783", "version": 1, "description": null }, "density": "sparse", "densityScore": 7, "componentCount": 2, "textChars": 272, "nDataPoints": 0, "notes": "This appears to be a continuation of a sentence from a previous page.", "elementsJson": [ "paragraph" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:36.764+00", "seconds": 1.741, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/52", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-52", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "domestic company borrow from off-shore, and that the few instances of which they are aware all involve state-owned enterprise borrowers.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:55+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab0f-5d1223b13096", "parentComponentId": null }, { "bbox": { "h": 0.024, "w": 0.766, "x": 0.117, "y": 0.093 }, "kind": "paragraph", "text": "domestic company borrow from off-shore, and that the few instances of which they are aware all involve state-owned enterprise borrowers.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:36.764+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "15fb1ebd-9a92-4810-a1db-c1407776b664", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 53, "type": "tension", "title": "The slide argues that NQ Mobile's cash claims are inflated and that acquisitions are used to launder money back into the company as fake revenue.", "function": "expose_contradiction", "rawType": "appendix_data", "block": null, "metadata": { "slideType": "appendix_data", "slideTypeCanon": { "name": "Appendix data", "slug": "appendix_data", "status": "active", "canonId": "019de52d-078a-745b-9ee4-c15f2f539acd", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "dense", "densityScore": 74, "componentCount": 10, "textChars": 1105, "nDataPoints": 5, "notes": "The slide argues that NQ Mobile's cash claims are inflated and that acquisitions are used to launder money back into the company as fake revenue.", "elementsJson": [ "data_table", "paragraph", "headline_text", "bullet_list", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:38.806+00", "seconds": 3.626, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/53", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-53", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "We believe that the onshore cash is far less than what NQ claims, and that it uses a portion of the excess to commit its fraud.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:55+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab0f-b193b99b1b93", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.74, "x": 0.14, "y": 0.81 }, "kind": "list", "text": "NQ's acquisition of the remaining 73.4% of Feiliu (aka FL Mobile) for a total of $62.7 million is likely corrupt.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9715a6b6-9f95-4671-ac58-fb3e4c0969f9", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "Net changes in cash + term deposit: 65,987", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:55+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab0f-b7a8aff31dcb", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.76, "x": 0.118, "y": 0.35 }, "kind": "paragraph", "text": "Transferring cash directly to the VIE would represent worst practices... We believe that the onshore cash is far less than what NQ claims, and that it uses a portion of the excess to commit its fraud.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7bfc3d83-3db3-43b0-b6ea-635514945777", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.76, "x": 0.118, "y": 0.72 }, "kind": "paragraph", "text": "There are reasons to believe (apart from the fact that NQ is involved) that NQ's recent acquisitions are likely corrupt transactions. NQ has completed or announced acquisitions totaling $25 million of cash and 15 million ADSes.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a1917a52-25e7-46bc-8b6e-3800ca60b21e", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.6, "x": 0.118, "y": 0.32 }, "kind": "paragraph", "text": "Note: Others mainly consist of currency translation differences ~$1.5mm.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d158dc86-9f47-48e6-89b0-4b6d51aeb7c3", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.76, "x": 0.118, "y": 0.87 }, "kind": "source-note", "text": "68 NQ usually / always makes its acquisitions with common shares. The ADSes are based on the 5:1 conversion ratio.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5b191d15-492e-452a-9d82-202b14ad3368", "parentComponentId": null }, { "bbox": { "h": 0.18, "w": 0.76, "x": 0.118, "y": 0.12 }, "kind": "table", "text": "OCF excluding other payables (7,407); ICF (1,131); Changes in other payables 72,556; Others 1,969; Net changes in cash + term deposit 65,987", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d971e222-e21a-46b0-8d7a-ce5bd27dbb6f", "parentComponentId": null }, { "bbox": { "h": 0.015, "w": 0.33, "x": 0.118, "y": 0.094 }, "kind": "title", "text": "VIE cash movement, excluding NQ Fujian", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7292808e-30d9-4c7a-8337-21ccb995e159", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.35, "x": 0.118, "y": 0.68 }, "kind": "title", "text": "NQ's Likely Corrupt Acquisitions", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ec06dfd6-77ce-4551-b80a-51f1faedc879", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "1b9637b1-69ec-47d5-ba19-43e0ddf08452", "evidence": "The slide explicitly argues that NQ uses acquisitions to commit fraud and divert IPO proceeds.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:38.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 53, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 54, "type": "tension", "title": "The slide serves as a forensic research note documenting suspicious business practices and potential shell company usage.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "balanced", "densityScore": 26, "componentCount": 4, "textChars": 585, "nDataPoints": 10, "notes": "The slide serves as a forensic research note documenting suspicious business practices and potential shell company usage.", "elementsJson": [ "paragraph", "bullet_list", "data_table", "footnote" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:37.707+00", "seconds": 2.398, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/54", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-54", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "It is a common tactic in China Fraud to use villagers as fake shareholders – sometimes they are paid small sums for their cooperation, other times their identities are used without their knowledge or consent.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:55+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab0f-9635c33c502e", "parentComponentId": null }, { "bbox": { "h": 0.8, "w": 0.7, "x": 0.15, "y": 0.08 }, "kind": "paragraph", "text": "The text describes suspicious share transfers to individuals appearing to be villagers, and questions the legitimacy of acquisitions of Beijing Red Infinity and Beijing Fanyue.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.707+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ecc43192-80c0-48dc-9dbb-b52014af8f4b", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.7, "x": 0.15, "y": 0.92 }, "kind": "source-note", "text": "Room 1313, Jingshui Hotel, No. 10, Puhui Beili, Haidian District, Beijing", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.707+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "65e630cf-d152-4afc-bf34-9e36b9fe3d1b", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.3, "x": 0.35, "y": 0.495 }, "kind": "table", "text": "Financial statements for Beijing Red Infinity Technology (2011-2012) showing assets, liabilities, equity, revenue, and net loss.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:37.707+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "223aadb7-6a18-478e-8b24-911ad45a5c4b", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "52f13cfe-f137-49dc-a754-1a5e5d833c2e", "evidence": "The slide systematically presents evidence of shell companies and fake shareholders to expose corporate fraud.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:37.707+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 54, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 55, "type": "tension", "title": "This is a text-heavy research note page detailing allegations of corporate fraud.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "balanced", "densityScore": 35, "componentCount": 5, "textChars": 873, "nDataPoints": 5, "notes": "This is a text-heavy research note page detailing allegations of corporate fraud.", "elementsJson": [ "bullet_list", "paragraph", "headline_text" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:38.254+00", "seconds": 2.808, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/55", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-55", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "NQ's focus on gaming and advertising will not allow it to \"grow into the fraud\" by generating real numbers approaching its fraudulent ones.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:55+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab0f-e8dad4a0fdf1", "parentComponentId": null }, { "bbox": null, "kind": "list", "text": "NQ's acquisition of 31.71% of Hesine for $0.5 million... NQ's 30% acquisition of Pansi for up to $2.9 million... NQ's $38 million of acquisition of NationSky...", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.254+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "49a9b601-de0c-4b4e-8627-3764f8128a47", "parentComponentId": null }, { "bbox": null, "kind": "paragraph", "text": "We theorize that the real purposes of these acquisitions are 1) to generate cash that will be recycled into NQ as fake revenue, and 2) line the pockets of the perpetrators.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.254+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "85137233-7ca7-4c55-bb70-e8fe4b9a2ffe", "parentComponentId": null }, { "bbox": null, "kind": "paragraph", "text": "NQ is attempting to pivot to a fraud that it hopes will be less obvious – gaming and advertising revenue. NQ's focus on gaming and advertising will not allow it to 'grow into the fraud' by generating real numbers approaching its fraudulent ones.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.254+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8c62951a-793e-4f50-aaaa-373d8a04288c", "parentComponentId": null }, { "bbox": null, "kind": "paragraph", "text": "NQ's gaming strategy is being executed through its now wholly-owned subsidiary Feiliu. NQ has likely fraudulently inflated the value of Feiliu by many times.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.254+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d18314b6-afb5-403e-b462-464caf3afa04", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "77f5748c-0143-4d2d-b9f6-1398d38a5817", "evidence": "The slide systematically lists acquisitions and business pivots as evidence of fraudulent activity.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:38.254+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 55, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 56, "type": "tension", "title": "The slide uses direct quotes from company executives to highlight inconsistencies in their business strategy and claims.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "dense", "densityScore": 68, "componentCount": 8, "textChars": 1661, "nDataPoints": 1, "notes": "The slide uses direct quotes from company executives to highlight inconsistencies in their business strategy and claims.", "elementsJson": [ "paragraph", "quote_block", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:42.659+00", "seconds": 6.788, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/56", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-56", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "NQ's consumer monetization platform is a myth, and that reality voids any legitimate rationale for focusing on gaming.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:56+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab10-54872c9dcbd1", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "paragraph", "text": "NQ's purported pivot into gaming is predicated on the fraudulent assertion that its user acquisition costs are the lowest in the world.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:42.659+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "85227586-1bcd-4c80-90e5-a8fa3d796f25", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.78, "x": 0.11, "y": 0.37 }, "kind": "paragraph", "text": "NQ's consumer monetization platform is a myth, and that reality voids any legitimate rationale for focusing on gaming.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:42.659+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d7c41cac-8269-4f0d-93b9-aecd1ad354c1", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.74, "x": 0.15, "y": 0.48 }, "kind": "quote", "text": "Why don't we take ads? I think the format of ads on mobile phones is not mature yet. Furthermore, there is a fundamental conflict between our safety service... and the advertising model.", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": null, "subkind": { "name": "Pull quote", "slug": "pull-quote", "status": "active", "canonId": "019de52c-fbf9-76fe-97e1-a0b7540445c9", "version": 1, "description": null }, "framework": null }, "subkind": "pull-quote", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:42.659+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4642071b-724b-4261-90b8-85391b5f9295", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.74, "x": 0.15, "y": 0.18 }, "kind": "quote", "text": "It's really about the platform. The fact that we built a platform where we can acquire users in... about seven cents per registered user on a blended basis.", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": null, "subkind": { "name": "Pull quote", "slug": "pull-quote", "status": "active", "canonId": "019de52c-fbf9-76fe-97e1-a0b7540445c9", "version": 1, "description": null }, "framework": null }, "subkind": "pull-quote", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:42.659+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b2b8b375-805a-469b-ad07-328979705987", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.74, "x": 0.15, "y": 0.65 }, "kind": "quote", "text": "We are excited about the progress of our expanded monetization efforts... We are now not only generating security subscription revenues but significant gaming and advertising revenues as well.", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": null, "subkind": { "name": "Pull quote", "slug": "pull-quote", "status": "active", "canonId": "019de52c-fbf9-76fe-97e1-a0b7540445c9", "version": 1, "description": null }, "framework": null }, "subkind": "pull-quote", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:42.659+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b6adbc2e-2f65-4955-9489-23fe4dc19be3", "parentComponentId": null }, { "bbox": null, "kind": "quote", "text": "\"It's really about the platform. The fact that we built a platform where we can acquire users in over 150 countries... we can acquire users in between, at about seven cents per registered user on a blended basis.\" — Omar Khan; \"Why don't we take ads? I think the format of ads on mobile phones is not mature yet. Furthermore, there is a fundamental conflict between our safety service, by its very nature, and the advertising model.\" — Yu Lin; \"I am pleased to report that we again achieved record revenues in the second quarter of 2013... We are now not only generating security subscription revenues but significant gaming and advertising revenues as well.\" — Dr. Henry Lin", "attrs": null, "canon": { "kind": { "name": "Quote", "slug": "quote", "status": "active", "canonId": "019de52c-f8fb-751e-8bc6-d58e2d59562a", "version": 1, "description": "Pull quote or testimonial." }, "tool": { "name": "Authority citation", "slug": "authority-citation", "status": "active", "bestFor": null, "canonId": "019dd9e1-49ae-7557-89ad-3fca70469b45", "version": 1, "bodyDocId": null, "description": "Quoting an authority figure, study, or precedent to lend weight.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:56+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab10-593555b9587b", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.85 }, "kind": "source-note", "text": "Footnotes 70, 71, 72 referencing interview transcripts and company presentations.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:42.659+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "79cc40f4-5467-4ac5-bbad-3adbdd7fe048", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "45f1b7cc-5b99-4d8d-aaf0-7b085c59779a", "evidence": "The slide explicitly labels company assertions as 'fraudulent' and uses contradictory quotes to prove it.", "framework": null, "confidence": 1, "extraction": { "at": "2026-05-02 20:51:42.659+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 56, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 57, "type": "tension", "title": "The slide uses a combination of anecdotal evidence from a former employee and specific technical accounting criticisms to build a case for fraud.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "balanced", "densityScore": 30, "componentCount": 5, "textChars": 673, "nDataPoints": 6, "notes": "The slide uses a combination of anecdotal evidence from a former employee and specific technical accounting criticisms to build a case for fraud.", "elementsJson": [ "paragraph", "bullet_list", "footnote" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:39.871+00", "seconds": 3.865, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/57", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-57", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "There are clear signs that PwC’s audits of NQ were sloppy.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:55+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab0f-d35fcc304a9c", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.74, "x": 0.14, "y": 0.65 }, "kind": "list", "text": "Failure to ensure that disclosures about cash balances by entity are correct. Classifying Cash and Equivalents as a Level 2 asset in 2012. Not booking restricted share issuance. Failure to ensure that share-based compensation is recorded.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:39.871+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c51641a9-9589-4f7e-8129-74f3f82612c3", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.764, "x": 0.118, "y": 0.445 }, "kind": "paragraph", "text": "There are clear signs that PwC's audits of NQ were sloppy. It is very difficult to know from the outside how diligently an auditor performed its audit of a given company...", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:39.871+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "293d2552-b7c6-4128-81ae-76a28372a98f", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.3, "x": 0.118, "y": 0.835 }, "kind": "source-note", "text": "73 NQ Q4 2012 earnings conference call. 74 NQ Q2 2013 earnings conference call. 75 NQ 2012 20-F, pp. 7-8. 76 NQ Q2 2013 earnings conference call. 77 id.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:39.871+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3e436a7a-b44e-4137-add6-cf7284307856", "parentComponentId": null }, { "bbox": { "h": 0.025, "w": 0.764, "x": 0.118, "y": 0.405 }, "kind": "title", "text": "NQ's Filings Make Clear that PwC's Audits Were Sloppy", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:39.871+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bed411d6-26f5-4283-9ccc-d180623dd34d", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "a5ce5f16-46d1-4895-b84f-e9923d77fbd9", "evidence": "The slide explicitly lists 'tells' of sloppy audits as evidence of potential fraud.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:39.871+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 57, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 58, "type": "tension", "title": "This appears to be a forensic research note exposing potential financial fraud or audit negligence.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "dense", "densityScore": 62, "componentCount": 8, "textChars": 1134, "nDataPoints": 6, "notes": "This appears to be a forensic research note exposing potential financial fraud or audit negligence.", "elementsJson": [ "bullet_list", "paragraph" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:42.952+00", "seconds": 6.93, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/58", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-58", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Recall, our view is that the cash probably is no there at all and this is just a book keeping/balancing exercise.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:55+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab0f-81ecf4f8413e", "parentComponentId": null }, { "bbox": { "h": 0.07, "w": 0.72, "x": 0.14, "y": 0.09 }, "kind": "list", "text": "Failure to validate that receivables from NQ's largest purported trade debtor, Yidatong, are aged over four months beyond what the contracts permits. Permitting NQ to reclassify significant costs from Cost of Sales to R&D.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:42.952+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "488a3d4b-07fb-49ee-818d-846b469a5da0", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.72 }, "kind": "paragraph", "text": "It's hard to imagine a scenario where cash and cash equivalents would be a level 2 asset. But, surprisingly, the auditor classified 2012 cash and cash equivalents as a level 2 asset.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:42.952+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "29c2f8b2-8611-4537-9114-f12391854fc7", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.78, "x": 0.11, "y": 0.37 }, "kind": "paragraph", "text": "The consolidated term deposit balance was $58.5 million and the parent co term deposit was $0. We question the audit procedures and if PWC has qualified accounting staff working on this audit.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:42.952+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "401f4d2b-5801-4482-8ca5-893c712fe9e6", "parentComponentId": null }, { "bbox": { "h": 0.12, "w": 0.78, "x": 0.11, "y": 0.23 }, "kind": "paragraph", "text": "At December 31, 2011, the Company reported consolidated cash and cash equivalents of $69 million and parent company cash of $49 million. The VIE reported a net increase in cash of $66 million, which is mathematically impossible.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:42.952+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "728051e9-91ae-4d98-a3ac-6d845085eb0f", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.81 }, "kind": "paragraph", "text": "Level 1 inputs - observable, quoted prices for identical assets or liabilities in active markets. Level 2 inputs - quoted prices for similar assets or liabilities in active markets.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:42.952+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d7f34ed0-223e-4566-aea0-00e230dca977", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.13, "x": 0.11, "y": 0.68 }, "kind": "title", "text": "Level 2 Cash", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:42.952+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "253c847a-1b4b-4dab-9262-bc4d90f0525d", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.06, "x": 0.11, "y": 0.19 }, "kind": "title", "text": "Cash", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:42.952+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ddb57e2d-3903-44bf-a4ba-5607a4ed6c8c", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 59, "type": "tension", "title": "This is a research note page detailing forensic accounting concerns.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 84, "componentCount": 9, "textChars": 3027, "nDataPoints": 4, "notes": "This is a research note page detailing forensic accounting concerns.", "elementsJson": [ "paragraph", "footnote" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:43.26+00", "seconds": 7.101, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/59", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-59", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "The Company is underreporting and misallocating share based compensation at the parent company.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:55+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab10-1753e328c922", "parentComponentId": null }, { "bbox": { "h": 0.085, "w": 0.772, "x": 0.118, "y": 0.665 }, "kind": "paragraph", "text": "The contract between Yidatong and NQ calls for settlement in one calendar month with payment on the 15th of the next calendar month. One calendar month settlement terms are normal trade terms and consistent with the contract between NQ and China Mobile which also call for one month settlement with payment being done on the 15th of each month. One month settlement is what other carriers have told us as well as retailers that sell NQ apps, including Telefónica and Verizon resellers.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:43.26+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "35b812b7-9f77-417b-b0a5-c0c161fb4614", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.772, "x": 0.118, "y": 0.345 }, "kind": "paragraph", "text": "The Company is underreporting and misallocating share based compensation at the parent company. For 2012, the Company expensed $24.5 million in share based compensation and disclosed $1.84 million cash compensation to executive officers and directors. Over the same timeframe, the Company booked $5.6mm of total G&A expenses (or 9% of total operating expenses) at the parent of which we believe no share based compensation was allocated. We believe that share based compensation was also not allocated to the parent operations in 2011 and 2010. First, the Company footnotes that share based compensation was included in the consolidated financial statements while no such footnote was included in the parent company footnotes. Second, our analysis of the VIE and WFOE 2011 financial data shows that a nominal amount, if any, share based compensation was accounted for at these operating entities. With the parent generating $20 million in sales (approximately 22% of total sales) and the VIE and WFOE generating the majority of the remaining revenues, the accounting and allocation of share based compensation appears to be another sign of a sloppy audit. A substantial amount of the share based compensation was from US management and therefore should have been allocated to the parent in a much higher amount than shown.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:43.26+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "52d09dc8-bf55-402d-abf8-82ebc2db134d", "parentComponentId": null }, { "bbox": { "h": 0.065, "w": 0.772, "x": 0.118, "y": 0.153 }, "kind": "paragraph", "text": "Based on the definition of cash and cash equivalents, our view is that the auditor was either not able to verify the cash or it's just another sign of a sloppy audit. The reclassification of the 2011 cash is a concern since that would imply that the auditor did see something since none of the cash and cash equivalents was put into level 1 assets as one would expect.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:43.26+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "794f066d-3811-4276-8169-511b183c0f44", "parentComponentId": null }, { "bbox": { "h": 0.055, "w": 0.772, "x": 0.118, "y": 0.232 }, "kind": "paragraph", "text": "As you can see from the level 2 definition, level 2 assets are much more risky and more difficult to value (compared to level 1 assets). The combination of cash at the VIE and the reclassification to Level 2 from Level 1 is a red flag. Especially, since we believe it was not transferred to the VIE in accordance with Chinese regulations.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:43.26+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "bef0a5cb-e154-48ef-ad48-27c0e969bffc", "parentComponentId": null }, { "bbox": { "h": 0.045, "w": 0.772, "x": 0.118, "y": 0.094 }, "kind": "paragraph", "text": "interest rates and yield curves. Examples include corporate bonds (investment grade, high yield), mortgage-backed securities, bank loans, loan commitments, less liquid listed equities, municipal bonds and certain OTC derivatives.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:43.26+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f3544be3-c241-4518-89fb-8dd7e91f49ed", "parentComponentId": null }, { "bbox": { "h": 0.015, "w": 0.45, "x": 0.118, "y": 0.895 }, "kind": "source-note", "text": "https://www.bj.10086.cn/Portals/0/revision/images/mwsphzglssdxywfc.pdf", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:43.26+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8514dd3d-ddf4-4012-82d4-42ec9aae6e3c", "parentComponentId": null }, { "bbox": { "h": 0.035, "w": 0.772, "x": 0.118, "y": 0.615 }, "kind": "title", "text": "Yidatong is not paying pursuant to the terms of the contract or in line with normal trade terms.", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:43.26+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "370f11b8-fa9b-4151-99ac-ce4a5032884c", "parentComponentId": null }, { "bbox": { "h": 0.018, "w": 0.25, "x": 0.118, "y": 0.312 }, "kind": "title", "text": "Share Based Compensation", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:43.26+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cc7052e7-e450-43b1-9606-6a5026b62264", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true }, { "page": 60, "type": "tension", "title": "The slide highlights a specific accounting manipulation where R&D expenses increased by 10x during consolidation.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "dense", "densityScore": 60, "componentCount": 7, "textChars": 1260, "nDataPoints": 24, "notes": "The slide highlights a specific accounting manipulation where R&D expenses increased by 10x during consolidation.", "elementsJson": [ "paragraph", "data_table" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:39.382+00", "seconds": 2.908, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/60", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-60", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "In order to give the appearance of high gross margins, the Company has reclassified a material amount of expenses from cost of goods sold to R&D.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:55+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab0f-fd758744b6df", "parentComponentId": null }, { "bbox": null, "kind": "metric", "text": "R&D expenses: 10x", "attrs": null, "canon": { "kind": { "name": "Metric", "slug": "metric", "status": "active", "canonId": "019de52c-f923-73bf-8081-d0b1a8c5264d", "version": 1, "description": "Big-number or KPI value." }, "tool": { "name": "Quantification", "slug": "quantification", "status": "active", "bestFor": null, "canonId": "019dd9e1-47ab-72ce-a079-aab1f5299e88", "version": 1, "bodyDocId": null, "description": "Translating a claim into numbers, charts, or tables.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": "primary", "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:55+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab10-01a5d2161ecf", "parentComponentId": null }, { "bbox": { "h": 0.085, "w": 0.784, "x": 0.108, "y": 0.093 }, "kind": "paragraph", "text": "Yidatong has DSO of more than 4 months. The actual realized payment terms are far beyond industry norms. This combined with the annual advances that NQ makes to Yidatong, and SAIC files that show much lower sales and amounts due to NQ, is a clear sign that something is wrong with this picture. What are the auditors looking at (or are they doing more listening that looking)?", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:39.382+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7738ee13-4db2-4b46-b456-f4e9e046fc56", "parentComponentId": null }, { "bbox": { "h": 0.042, "w": 0.784, "x": 0.108, "y": 0.249 }, "kind": "paragraph", "text": "In order to give the appearance of high gross margins, the Company has reclassified a material amount of expenses from cost of goods sold to R&D. Based on our analysis of 2011 SAIC files, R&D expenses increased by 10x (or $4.5mm) during consolidation as a result of a shift in costs.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:39.382+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "88c8305b-e235-4f47-862e-c1e04179ebb4", "parentComponentId": null }, { "bbox": { "h": 0.042, "w": 0.784, "x": 0.108, "y": 0.668 }, "kind": "paragraph", "text": "The Company discloses that most of the R&D is done in China. Therefore, it is surprising to see such a large increase in R&D and a related decrease in cost of goods sold. Also, there are incentives for Chinese companies to book as much to R&D as possible as a result of tax incentives.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:39.382+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9f5c8826-965f-4245-960b-62ebe8139751", "parentComponentId": null }, { "bbox": { "h": 0.285, "w": 0.784, "x": 0.108, "y": 0.315 }, "kind": "table", "text": "2011 financial consolidation table showing Parent, VIE, WFOE, Combined, Adjustments, and Consolidated figures.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:39.382+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "865f5c86-ab72-486b-98a4-ff04c3a33223", "parentComponentId": null }, { "bbox": { "h": 0.018, "w": 0.435, "x": 0.108, "y": 0.212 }, "kind": "title", "text": "Reallocation of Costs to Boost Gross Margin.", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:39.382+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e1dae9f8-e27d-4ac6-a121-9a99c375ec21", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "41fee149-a519-41f5-b7b1-3cfeab729557", "evidence": "The slide explicitly identifies accounting manipulation (reclassification of costs) to mislead investors on gross margins.", "framework": null, "confidence": 0.95, "extraction": { "at": "2026-05-02 20:51:39.382+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 60, "frameworkName": "fraud-exposure" } ], "arcBeats": [], "loops": [], "locked": true }, { "page": 61, "type": "appendix", "function": "appendix", "rawType": "appendix_data", "block": null, "metadata": { "slideType": "appendix_data", "slideTypeCanon": { "name": "Appendix data", "slug": "appendix_data", "status": "active", "canonId": "019de52d-078a-745b-9ee4-c15f2f539acd", "version": 1, "description": null }, "function": "appendix", "functionCanon": { "name": "Appendix", "slug": "appendix", "status": "active", "canonId": "019de52d-138d-750b-83c3-49b4bc7a7a38", "version": 1, "description": null }, "density": "sparse", "densityScore": 4, "componentCount": 2, "textChars": 96, "nDataPoints": 0, "notes": null, "elementsJson": [ "data_table" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:38.913+00", "seconds": 2.265, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/61", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-61", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": { "h": 0.685, "w": 0.764, "x": 0.118, "y": 0.133 }, "kind": "table", "text": "Table containing store visit data for Atlanta and Boston locations.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.913+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a2eca91c-68cf-42db-9e35-cdde7c6d3d2b", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.25, "x": 0.118, "y": 0.098 }, "kind": "title", "text": "Appendix A: U.S. Store Visits", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.913+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d7d9e6b3-71ba-4773-a14b-93d1a68ebee7", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 62, "type": "analysis", "title": "Page 62 of 81", "function": "analyze_data", "rawType": "appendix_data", "block": null, "metadata": { "slideType": "appendix_data", "slideTypeCanon": { "name": "Appendix data", "slug": "appendix_data", "status": "active", "canonId": "019de52d-078a-745b-9ee4-c15f2f539acd", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "sparse", "densityScore": 13, "componentCount": 1, "textChars": 144, "nDataPoints": 63, "notes": "Page 62 of 81", "elementsJson": [ "data_table" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:38.559+00", "seconds": 1.9, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/62", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-62", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": { "h": 0.85, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "table", "text": "Table of retail store visit observations including location, retailer, address, city, product presence, sales volume, and brochure availability.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.559+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b9cb42f9-2236-4c22-9ef8-97730da6d5a2", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 63, "type": "analysis", "title": "The table appears to be a raw data dump from a field survey or mystery shopping exercise.", "function": "analyze_data", "rawType": "appendix_data", "block": null, "metadata": { "slideType": "appendix_data", "slideTypeCanon": { "name": "Appendix data", "slug": "appendix_data", "status": "active", "canonId": "019de52d-078a-745b-9ee4-c15f2f539acd", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "sparse", "densityScore": 14, "componentCount": 2, "textChars": 106, "nDataPoints": 112, "notes": "The table appears to be a raw data dump from a field survey or mystery shopping exercise.", "elementsJson": [ "data_table" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:38.702+00", "seconds": 1.828, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/63", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-63", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": { "h": 0.02, "w": 0.08, "x": 0.81, "y": 0.95 }, "kind": "paragraph", "text": "Page 63 of 81", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.702+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f99ec076-d38b-48a6-8413-78a9307b873f", "parentComponentId": null }, { "bbox": { "h": 0.85, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "table", "text": "Table containing columns: City, Brand, Address, Location, Awareness, Sales Frequency, Stocked", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:38.702+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8f04868b-5193-48ea-9fe6-f0bbb87dc791", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 64, "type": "analysis", "title": "Page 64 of 81", "function": "analyze_data", "rawType": "appendix_data", "block": null, "metadata": { "slideType": "appendix_data", "slideTypeCanon": { "name": "Appendix data", "slug": "appendix_data", "status": "active", "canonId": "019de52d-078a-745b-9ee4-c15f2f539acd", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "sparse", "densityScore": 12, "componentCount": 1, "textChars": 130, "nDataPoints": 14, "notes": "Page 64 of 81", "elementsJson": [ "data_table" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:40.799+00", "seconds": 3.787, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/64", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-64", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": { "h": 0.87, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "table", "text": "Table of store audit data including region, retailer, address, city, display status, sales performance, and brochure availability.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:40.799+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b4e12860-f716-4d4a-80cb-60d1475fd082", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 65, "type": "analysis", "title": "Page 65 of 81", "function": "analyze_data", "rawType": "appendix_data", "block": null, "metadata": { "slideType": "appendix_data", "slideTypeCanon": { "name": "Appendix data", "slug": "appendix_data", "status": "active", "canonId": "019de52d-078a-745b-9ee4-c15f2f539acd", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "sparse", "densityScore": 4, "componentCount": 1, "textChars": 120, "nDataPoints": 0, "notes": "Page 65 of 81", "elementsJson": [ "data_table" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:39.152+00", "seconds": 2.048, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/65", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-65", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": { "h": 0.85, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "table", "text": "Table showing store location, retailer, address, city, product receipt status, inventory percentage, and display status.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:39.152+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cea4d109-7731-4d7f-ac76-539263a34604", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 66, "type": "analysis", "title": "The table appears to be a raw data dump of store-level audits or inventory checks.", "function": "analyze_data", "rawType": "appendix_data", "block": null, "metadata": { "slideType": "appendix_data", "slideTypeCanon": { "name": "Appendix data", "slug": "appendix_data", "status": "active", "canonId": "019de52d-078a-745b-9ee4-c15f2f539acd", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "sparse", "densityScore": 13, "componentCount": 1, "textChars": 79, "nDataPoints": 98, "notes": "The table appears to be a raw data dump of store-level audits or inventory checks.", "elementsJson": [ "data_table" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:40.801+00", "seconds": 3.558, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/66", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-66", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": { "h": 0.82, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "table", "text": "Table of store locations, carriers, addresses, cities, and performance metrics.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:40.801+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cbbf068b-43da-4c2b-9547-a685550e538a", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 67, "type": "tension", "title": "The slide uses specific tax regulation citations to highlight discrepancies between SAIC filings and reported revenue.", "function": "expose_contradiction", "rawType": "appendix_disclosure", "block": null, "metadata": { "slideType": "appendix_disclosure", "slideTypeCanon": { "name": "Appendix disclosure", "slug": "appendix_disclosure", "status": "active", "canonId": "019de52d-07b2-7549-8e8b-932a19f6e616", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "balanced", "densityScore": 26, "componentCount": 5, "textChars": 474, "nDataPoints": 6, "notes": "The slide uses specific tax regulation citations to highlight discrepancies between SAIC filings and reported revenue.", "elementsJson": [ "headline_text", "paragraph", "bullet_list", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:39.806+00", "seconds": 2.548, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/67", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-67", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "NQ's book cookers made the following tax-related errors in producing fraudulent financials for its various entities.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:56+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab10-ad29e490d780", "parentComponentId": null }, { "bbox": { "h": 0.635, "w": 0.764, "x": 0.118, "y": 0.185 }, "kind": "list", "text": "Detailed bullet points outlining specific tax discrepancies regarding VAT vs Business Tax payments in 2011 and 2012.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:39.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0cd3d9b6-e900-4e2b-9cc0-e055cffa2f74", "parentComponentId": null }, { "bbox": { "h": 0.032, "w": 0.764, "x": 0.118, "y": 0.138 }, "kind": "paragraph", "text": "NQ's book cookers made the following tax-related errors in producing fraudulent financials for its various entities.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:39.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b5a647e5-5244-46d0-94d1-534e40031f42", "parentComponentId": null }, { "bbox": { "h": 0.105, "w": 0.764, "x": 0.118, "y": 0.825 }, "kind": "source-note", "text": "Footnotes 79-83 detailing specific regulatory sources and financial filing references.", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:39.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5d615f82-7bba-4be3-b4f4-46c5b3cfcbd1", "parentComponentId": null }, { "bbox": { "h": 0.021, "w": 0.435, "x": 0.118, "y": 0.098 }, "kind": "title", "text": "Appendix B: SAIC Financial Fraud Indicia", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:39.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "0027d04d-9376-4d2b-90f7-73d5381efe01", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "9a7d351d-3af5-4b17-b1bf-128f65e16fde", "evidence": "The slide systematically identifies accounting errors to prove financial fraud.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-05-02 20:51:39.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 67, "frameworkName": "fraud-exposure" } ], "arcBeats": [ { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 68, "type": "tension", "title": "The slide presents a forensic accounting argument regarding potential financial fraud by NQ Mobile.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 79, "componentCount": 8, "textChars": 3020, "nDataPoints": 10, "notes": "The slide presents a forensic accounting argument regarding potential financial fraud by NQ Mobile.", "elementsJson": [ "paragraph", "bullet_list", "footnote" ], "confidence": 0.95, "extraction": { "model": "google/gemini-3.1-flash-lite-preview", "runId": null, "at": "2026-07-17 03:31:45.761+00", "seconds": 4.562, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/68", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-68", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Omitting a tax preference from the prospectus is much less likely when the company's financials are genuine.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:57+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab10-d14bef295050", "parentComponentId": null }, { "bbox": { "h": 0.15, "w": 0.72, "x": 0.14, "y": 0.66 }, "kind": "list", "text": "NQ's SEC disclosures and SAIC financials show that NQ is shifting impermissibly high amounts of income from NQ's variable interest entity (\"VIE\") to NQ Beijing in order to avoid paying income tax. NQ claims that NQ Beijing was exempt from corporate income tax in 2011, while the VIE paid corporate income tax at 15%. Under NQ's onshore corporate structure, the vast majority of NQ Beijing's 2011 revenue consisted of sales to the VIE. The year before (2010), NQ Beijing only booked RMB 1.5 million in revenue, so the VIE would not have been shifting revenue to it until 2011.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-07-17 03:31:45.761+00", "model": "google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "2a6ea046-3d7d-459e-81a5-a6182d9e5910", "parentComponentId": null }, { "bbox": { "h": 0.22, "w": 0.72, "x": 0.14, "y": 0.43 }, "kind": "list", "text": "Omitting from NQ's 2011 prospectus a purported income tax preference for NQ Beijing. In the prospectus, NQ stated that NQ Beijing \"was subject to the prevailing income tax rate of 25% on taxable income for the years ended 2008, 2009, and 2010.\" However, in the 2011 20-F filed only 10 months later, NQ stated that NQ Beijing \"was qualified as a software enterprise under the New CIT Law, which was entitled to enjoy preferential income tax treatment of income tax exemption for the first two years when it became profitable, followed by three years of preferential income tax rate of 12.5% up to 2015...Therefore, NetQin Beijing was not required pay any income tax for the years ended December 31, 2009, 2010, and 2011.\" Omitting a tax preference from the prospectus is much less likely when the company's financials are genuine.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-07-17 03:31:45.761+00", "model": "google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d952d28a-21f7-4daa-8a25-7f7d9ef72a63", "parentComponentId": null }, { "bbox": { "h": 0.13, "w": 0.72, "x": 0.14, "y": 0.28 }, "kind": "paragraph", "text": "PRC GAAP mandates that the VAT credit or refund be recognized as Non-Operating Income. However, NQ Beijing had no such income in either 2011 or 2012. If NQ Beijing's SAIC financials were not fraudulent, they would show at least a few million RMB in Non-Operating Income in each year. Per a newsletter posted by the Haidian Tax Bureau (the tax bureau that receives taxes from NQ Beijing), cumulative VAT refunds to approximately 2,000 Haidian software companies in 2011 exceeded RMB 380 million (an average of about RMB 200,000 per company).", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": null, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-07-17 03:31:45.761+00", "model": "google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "283d36b5-c39a-48d4-b4e6-15ec470b3607", "parentComponentId": null }, { "bbox": { "h": 0.11, "w": 0.72, "x": 0.14, "y": 0.16 }, "kind": "paragraph", "text": "The effective VAT for in-house developed software is 3% of sales, which consists of the 17% statutory VAT NQ pays on its software sales, netted against a) VAT it paid on its inputs, which are generally very low for software companies, and b) a credit or refund from the tax bureau sufficient to ensure the effective VAT is 3%. Again, NQ Beijing's SAIC financials show that its domestic revenue was RMB 113.6 million and RMB 154.7 million in 2011 and 2012, respectively.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": null, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-07-17 03:31:45.761+00", "model": "google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "34adce67-039e-4dab-8912-32c7f17cf814", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.72, "x": 0.14, "y": 0.09 }, "kind": "paragraph", "text": "qualify for this income tax preference, at least 35% of NQ Beijing's revenue would have to come from software sales. At least half of the software sold must be developed in-house.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": null, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-07-17 03:31:45.761+00", "model": "google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6a7682fc-a26a-48f6-aae5-1d9cec24fa1b", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.72, "x": 0.14, "y": 0.82 }, "kind": "paragraph", "text": "By purporting to shift about two-thirds of the VIE's revenue to NQ Beijing in 2011, NQ lowered the VIE's gross margin from 62% in 2010 to 17% in 2011. Purportedly as a result of this shift, the VIE paid only RMB 106,000 in income taxes in 2011, which was", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": null, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-07-17 03:31:45.761+00", "model": "google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6fedaa8a-c148-4e79-98a9-e51c6f9c10a1", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.72, "x": 0.14, "y": 0.89 }, "kind": "source-note", "text": "84-88: Citations to tax bureau newsletters and SEC filings (20-F).", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": "source-note", "groupRole": null, "confidence": null, "extraction": { "at": "2026-07-17 03:31:45.761+00", "model": "google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ea84b023-a4bf-471e-990d-431c17427ba4", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "c7172058-dacf-4147-8a4b-1eab557d3e43", "evidence": "The slide systematically compares public financial disclosures against regulatory requirements to suggest fraudulent activity.", "framework": null, "confidence": 0.9, "extraction": { "at": "2026-07-17 03:31:45.761+00", "model": "google/gemini-3.1-flash-lite-preview", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 68, "frameworkName": "fraud-exposure" } ], "arcBeats": [ { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 69, "type": "tension", "title": "This slide is part of a short-seller research report (likely Muddy Waters or similar) alleging accounting fraud.", "function": "expose_contradiction", "rawType": "expose_contradiction", "block": null, "metadata": { "slideType": "expose_contradiction", "slideTypeCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-124c-75aa-984a-0a3d0d8fc8df", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "overcrowded", "densityScore": 85, "componentCount": 9, "textChars": 2715, "nDataPoints": 10, "notes": "This slide is part of a short-seller research report (likely Muddy Waters or similar) alleging accounting fraud.", "elementsJson": [ "paragraph", "bullet_list", "footnote" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:47.716+00", "seconds": 10.097, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/69", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-69", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "The reason NQ’s SAIC financials show this revenue shift is because the Company pays minimal PRC taxes because it has far less profit than it claims. The Company’s SAIC and SEC financials are fraudulent.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:57+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab11-19bc21bf4812", "parentComponentId": null }, { "bbox": { "h": 0.13, "w": 0.66, "x": 0.17, "y": 0.55 }, "kind": "list", "text": "NationSky’s balance sheet shows too few taxes due as of December 31, 2012. NQ purports that Nation Sky generated $12.6 million of revenue in 2012, although NationSky’s SAIC financials actually show $15.2 million of revenue. (The profit numbers are essentially the same though.) Chinese companies file monthly tax returns for VAT and Business Tax, while they file income tax returns on a quarterly basis. The yearend taxes payable balance should be at least approximately RMB 600,000. The balance sheet shows only RMB 38,000 payable.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:47.716+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6bee24e1-5987-47af-9a98-7eb1d32ad0b9", "parentComponentId": null }, { "bbox": { "h": 0.13, "w": 0.66, "x": 0.17, "y": 0.29 }, "kind": "list", "text": "NQ claims that Beijing Feiliu (“FL Mobile” or “FL”) pays no income tax in 2012 and 2013, and a reduced rate thereafter because it was approved for a software enterprise tax preference under the new tax law. This is not true. The preference is only available for newly-established software companies. FL was established in 2009, but obtained qualified software company status only in 2011. (FL would have gone through the qualification process after establishment in order to be eligible for VAT refunds.) In order to enjoy the tax holiday, FL would need to have obtained its qualification in 2010.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:47.716+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9493c4ce-a252-4523-91c2-921a910d9b69", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.66, "x": 0.17, "y": 0.09 }, "kind": "paragraph", "text": "only 27.7% of the VIE's 2010 income taxes, while the VIE's purported revenue grew 193.2% in 2011.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:47.716+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "22e17f05-be31-434f-959d-f4f3a91bcba0", "parentComponentId": null }, { "bbox": { "h": 0.07, "w": 0.66, "x": 0.17, "y": 0.14 }, "kind": "paragraph", "text": "NQ Beijing and the VIE are located in the same building and pay taxes to the same district tax office. PRC tax law requires business between related entities to be conducted at prices equivalent to those for arms length transactions. It is implausible that the VIE would be permitted to shift this much profit from an entity that pays income taxes to one that does not.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:47.716+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "43f86930-3150-4f85-95dc-71356f83e0d5", "parentComponentId": null }, { "bbox": { "h": 0.1, "w": 0.66, "x": 0.17, "y": 0.43 }, "kind": "paragraph", "text": "FL’s tax preference (forgetting the qualification timing issue) would only be valid for two years from and including its first profitable year. NQ reported in its 20-F a US GAAP profit of $119,000 in 2011 on sales of $2.1 million (from SAIC). It is unlikely that FL was unprofitable in 2011 for PRC tax accounting purposes. The claim that FL would not have to pay tax in 2013 seems to be another example of bungled tax treatment resulting from fraudulent accounting.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:47.716+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "51b57ec8-b4ed-45ea-b9bb-c341a89b4ee3", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.66, "x": 0.17, "y": 0.69 }, "kind": "paragraph", "text": "Another suspicious element of NationSky’s income statement is that its 2012 sales and marketing expenses of only $479,000 seem too low to support a sales, presales, and marketing staff of over 80 people in 10 offices.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:47.716+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6e6ffa1d-20ab-470e-90a9-05582c8becb0", "parentComponentId": null }, { "bbox": { "h": 0.04, "w": 0.66, "x": 0.17, "y": 0.23 }, "kind": "paragraph", "text": "The reason NQ's SAIC financials show this revenue shift is because the Company pays minimal PRC taxes because it has far less profit than it claims. The Company's SAIC and SEC financials are fraudulent.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:47.716+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7648bc8a-6d3e-443b-b098-dd147a567868", "parentComponentId": null }, { "bbox": { "h": 0.05, "w": 0.66, "x": 0.17, "y": 0.85 }, "kind": "source-note", "text": "89-92 footnotes detailing sources", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:47.716+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "a3b93860-f020-44f3-8b2e-ff0c95c9edbf", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 70, "type": "analysis", "title": "The table contains 90 rows of data detailing specific device configurations across multiple Chinese cities.", "function": "analyze_data", "rawType": "appendix_data", "block": null, "metadata": { "slideType": "appendix_data", "slideTypeCanon": { "name": "Appendix data", "slug": "appendix_data", "status": "active", "canonId": "019de52d-078a-745b-9ee4-c15f2f539acd", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "sparse", "densityScore": 14, "componentCount": 2, "textChars": 97, "nDataPoints": 90, "notes": "The table contains 90 rows of data detailing specific device configurations across multiple Chinese cities.", "elementsJson": [ "headline_text", "data_table" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:40.043+00", "seconds": 2.06, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/70", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-70", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": { "h": 0.8, "w": 0.34, "x": 0.33, "y": 0.11 }, "kind": "table", "text": "City, Store, Phone, Antivirus-if any (English), NQ", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:40.043+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "84ba9bdd-7da4-4550-ad74-9132791383db", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.3, "x": 0.35, "y": 0.09 }, "kind": "title", "text": "Store Checks for Security App Pre-Installations", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:40.043+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1d307180-2ead-48e5-8e54-89dab7d7d64a", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 71, "type": "tension", "title": "Includes a Wireshark packet capture screenshot and WHOIS registration details for nqsrv.com.", "function": "expose_contradiction", "rawType": "appendix_disclosure", "block": null, "metadata": { "slideType": "appendix_disclosure", "slideTypeCanon": { "name": "Appendix disclosure", "slug": "appendix_disclosure", "status": "active", "canonId": "019de52d-07b2-7549-8e8b-932a19f6e616", "version": 1, "description": null }, "function": "expose_contradiction", "functionCanon": { "name": "Expose contradiction", "slug": "expose_contradiction", "status": "active", "canonId": "019de52d-171f-776f-887c-73edaff4cf9c", "version": 1, "description": null }, "density": "dense", "densityScore": 56, "componentCount": 8, "textChars": 1139, "nDataPoints": 0, "notes": "Includes a Wireshark packet capture screenshot and WHOIS registration details for nqsrv.com.", "elementsJson": [ "headline_text", "paragraph", "screenshot" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:41.883+00", "seconds": 3.867, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/71", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-71", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "We were able to show that the sites are located and hosted in China, and are owned by NQ.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:57+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab10-e82c82813cbf", "parentComponentId": null }, { "bbox": { "h": 0.125, "w": 0.765, "x": 0.118, "y": 0.258 }, "kind": "image", "text": "Wireshark packet capture showing traffic to us.nqsrv.com", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.883+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c9afda2e-1034-416b-9270-802afed08d8c", "parentComponentId": null }, { "bbox": { "h": 0.065, "w": 0.333, "x": 0.118, "y": 0.391 }, "kind": "paragraph", "text": "Domain Name: nqsrv.com\nRegistrar: Name.com LLC\nExpiration Date: 2014-01-09 05:11:41\nCreation Date: 2012-01-09 05:11:41", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.883+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "137a42e4-46cb-4755-aece-e62855ae7251", "parentComponentId": null }, { "bbox": { "h": 0.055, "w": 0.765, "x": 0.118, "y": 0.168 }, "kind": "paragraph", "text": "During our investigation we discovered that that app is communicates with remote servers. We extracted the domains and IP that the app reaches and researched the IP using open source tools and services such as \"WhoIS\". We were able to show that the sites are located and hosted in China, and are owned by NQ.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.883+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "15e21565-4a2e-4c62-aa32-27df8b35b31e", "parentComponentId": null }, { "bbox": { "h": 0.016, "w": 0.455, "x": 0.118, "y": 0.137 }, "kind": "paragraph", "text": "Data is sent from the App to NQ servers located in China", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.883+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4d18d968-2f44-44f1-9433-dd496eff59e9", "parentComponentId": null }, { "bbox": { "h": 0.155, "w": 0.333, "x": 0.118, "y": 0.483 }, "kind": "paragraph", "text": "REGISTRANT CONTACT INFO\nNetQin Mobile Inc.\nzhang guobao\nNo.4 Building, Heping Li East Street 11\nDongcheng District, Beijing, China\nbeijing\nbeijing\n100013\nCN\nPhone: +86.1085655555\nFax: +86.1085655518\nEmail Address: zhangguobao@netqin.com", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.883+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8db95a72-828d-4828-a258-8edd4332d5fc", "parentComponentId": null }, { "bbox": { "h": 0.155, "w": 0.333, "x": 0.118, "y": 0.6 }, "kind": "paragraph", "text": "ADMINISTRATIVE CONTACT INFO\nNetQin Mobile Inc.\nzhang guobao\nNo.4 Building, Heping Li East Street 11\nDongcheng District, Beijing, China\nbeijing\nbeijing\n100013\nCN\nPhone: +86.1085655555\nFax: +86.1085655518\nEmail Address: zhangguobao@netqin.com", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.883+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "e28e70e1-5da2-420f-bd82-51075ae9e7fc", "parentComponentId": null }, { "bbox": { "h": 0.022, "w": 0.365, "x": 0.118, "y": 0.098 }, "kind": "title", "text": "Appendix C: Software Engineer Report", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.883+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "82fc1fc2-9612-40d4-b037-451f2b019484", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 72, "type": "appendix", "title": "The slide documents network traffic analysis, specifically identifying a server in Beijing associated with TalkingData.", "function": "other", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "other", "functionCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-15e1-75bc-99dc-07732380e2ce", "version": 1, "description": null }, "density": "sparse", "densityScore": 21, "componentCount": 5, "textChars": 581, "nDataPoints": 0, "notes": "The slide documents network traffic analysis, specifically identifying a server in Beijing associated with TalkingData.", "elementsJson": [ "map", "paragraph", "screenshot" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:41.048+00", "seconds": 3.017, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/72", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-72", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "We have also encountered requests to servers, which were not owned by NQ, but rather a 3rd party company named TalkingData, especially to: http://tdcv3.talkingdata.net - 211.151.121.41", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:58+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab11-4509a0a06e1c", "parentComponentId": null }, { "bbox": { "h": 0.28, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "image", "text": "Map showing server location in Beijing", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Map", "slug": "map", "status": "active", "canonId": "019de52c-fe4d-77bd-b0a4-d72d58b9e5a4", "version": 1, "description": null }, "framework": null }, "subkind": "map", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.048+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "35ef193b-0ac9-4064-8a47-7b58188937c7", "parentComponentId": null }, { "bbox": { "h": 0.25, "w": 0.78, "x": 0.11, "y": 0.52 }, "kind": "image", "text": "Packet capture showing HTTP POST request to tdcv3.talkingdata.net", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.048+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7f015e5e-3e0b-4945-b5f0-bd0b21fbeb74", "parentComponentId": null }, { "bbox": { "h": 0.06, "w": 0.78, "x": 0.11, "y": 0.4 }, "kind": "paragraph", "text": "We have also encountered requests to servers, which were not owned by NQ, but rather a 3rd party company named TalkingData, especially to: http://tdcv3.talkingdata.net - 211.151.121.41", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.048+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "432bdf09-9b01-4c40-a020-119d1d335015", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.78, "x": 0.11, "y": 0.48 }, "kind": "paragraph", "text": "TalkingData is a company providing mobile data collection and statistical analysis platform, located in China.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.048+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4364534f-6e07-44ba-82f5-2a230e5282d7", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 73, "type": "appendix", "title": "This appears to be a standard WHOIS lookup result used for corporate verification or due diligence.", "function": "appendix", "rawType": "appendix", "block": null, "metadata": { "slideType": "appendix", "slideTypeCanon": { "name": "Appendix", "slug": "appendix", "status": "active", "canonId": "019de52d-0762-71f8-b564-89ab863301cc", "version": 1, "description": null }, "function": "appendix", "functionCanon": { "name": "Appendix", "slug": "appendix", "status": "active", "canonId": "019de52d-138d-750b-83c3-49b4bc7a7a38", "version": 1, "description": null }, "density": "balanced", "densityScore": 32, "componentCount": 2, "textChars": 1522, "nDataPoints": 0, "notes": "This appears to be a standard WHOIS lookup result used for corporate verification or due diligence.", "elementsJson": [ "data_table", "map" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:43.392+00", "seconds": 5.171, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/73", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-73", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": { "h": 0.26, "w": 0.78, "x": 0.12, "y": 0.46 }, "kind": "image", "text": "Map showing Beijing location", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Map", "slug": "map", "status": "active", "canonId": "019de52c-fe4d-77bd-b0a4-d72d58b9e5a4", "version": 1, "description": null }, "framework": null }, "subkind": "map", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:43.392+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "cc543097-ca7f-4c6f-bd46-20466464c0a9", "parentComponentId": null }, { "bbox": { "h": 0.36, "w": 0.78, "x": 0.12, "y": 0.09 }, "kind": "paragraph", "text": "Domain Name .................... talkingdata.net\nSponsoring Registrar ............... HICHINA ZHICHENG TECHNOLOGY LTD.\nName Server .................... dns21.hichina.com\n dns22.hichina.com\nRegistrant ID .................... HC-329766208-CN\nRegistrant Name .................. pan hierarch\nRegistrant Organization .......... Beijing tendcloud Co.Ltd\nRegistrant Address ............... Bldg 2 11 Heping Li East St Dongcheng District Beijing, P.R.China\nRegistrant City .................. BEIJING\nRegistrant Province/State ........ BEIJING\nRegistrant Postal Code ........... 100013\nRegistrant Country Code .......... CN\nRegistrant Phone Number .......... +86.13810520844\nRegistrant Fax ................... +86.13810520844\nRegistrant Email ................. hierarch.pan@tendcloud.com\nAdministrative ID ................ HC-835631385-CN\nAdministrative Name .............. pan hierarch\nAdministrative Organization ...... Beijing tendcloud Co.Ltd\nAdministrative Address ........... Bldg 2 11 Heping Li East St Dongcheng District Beijing, P.R.China\nAdministrative City .............. BEIJING\nAdministrative Province/State .... BEIJING\nAdministrative Postal Code ....... 100013\nAdministrative Country Code ...... CN\nAdministrative Phone Number ...... +86.01052458220 - 0000\nAdministrative Fax ............... +86.01052458220 - 0000\nAdministrative Email ............. hierarch.pan@tendcloud.com\nServer : 211.151.126.90 (talkingdata.net)\nCity : Beijing\nCountry : China (CN)", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:43.392+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9eea45cc-d356-44e8-85ff-503a25198b8d", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 74, "type": "analysis", "title": "The slide documents specific security vulnerabilities related to unencrypted HTTP traffic and data exfiltration to third-party providers like TalkingData and Ne", "function": "analyze_data", "rawType": "appendix_data", "block": null, "metadata": { "slideType": "appendix_data", "slideTypeCanon": { "name": "Appendix data", "slug": "appendix_data", "status": "active", "canonId": "019de52d-078a-745b-9ee4-c15f2f539acd", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "dense", "densityScore": 57, "componentCount": 8, "textChars": 817, "nDataPoints": 12, "notes": "The slide documents specific security vulnerabilities related to unencrypted HTTP traffic and data exfiltration to third-party providers like TalkingData and NetQin.", "elementsJson": [ "data_table", "paragraph", "bullet_list" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:41.517+00", "seconds": 2.901, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/74", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-74", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "The leaked information could lead to targeted attacks and reveal sensitive details about the user\\device such as current location using Wi-Fi signals triangulation, device model\\version for targeting specific exploitation methods etc.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:58+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab11-9b4f29381b6d", "parentComponentId": null }, { "bbox": { "h": 0.072, "w": 0.458, "x": 0.147, "y": 0.624 }, "kind": "list", "text": "Device Model, Carrier, GSM Cell information, Wi-Fi SSIDs + percentage of reception", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.517+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "c79a803b-7efd-4ebd-8dce-d944b88ff1a6", "parentComponentId": null }, { "bbox": { "h": 0.018, "w": 0.428, "x": 0.117, "y": 0.433 }, "kind": "paragraph", "text": "TalkingData.net – 3rd party Chinese service provider", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.517+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "949ceca7-5373-4cfd-8454-60503461b1b2", "parentComponentId": null }, { "bbox": { "h": 0.036, "w": 0.775, "x": 0.117, "y": 0.778 }, "kind": "paragraph", "text": "The leaked information could lead to targeted attacks and reveal sensitive details about the user's device such as current location using Wi-Fi signals triangulation, device model/version for targeting specific exploitation methods etc.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.517+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ca741413-74ce-496c-a248-cd595045ea56", "parentComponentId": null }, { "bbox": { "h": 0.018, "w": 0.635, "x": 0.117, "y": 0.126 }, "kind": "paragraph", "text": "In the limited amount of time we were able to detect the following communications:", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.517+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d1ab028a-e5cf-4951-9043-81269751b72f", "parentComponentId": null }, { "bbox": { "h": 0.265, "w": 0.775, "x": 0.117, "y": 0.155 }, "kind": "table", "text": "Table showing Destination/Trigger, Request, and Response for various app communications.", "attrs": null, "canon": { "kind": { "name": "Table", "slug": "table", "status": "active", "canonId": "019de52c-f9c8-7148-8119-eaac9594cd28", "version": 1, "description": "Tabular data layout." }, "tool": null, "subkind": { "name": "Data table", "slug": "data", "status": "active", "canonId": "019de52d-02d5-75b8-8abf-88e92bf63569", "version": 1, "description": null }, "framework": null }, "subkind": "data", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.517+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "828a4d28-d18d-4b96-9199-998acf25c3f8", "parentComponentId": null }, { "bbox": { "h": 0.018, "w": 0.155, "x": 0.117, "y": 0.843 }, "kind": "title", "text": "Software Update", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.517+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "5a1c4b86-ce1b-498b-aa95-c6efec2696bb", "parentComponentId": null }, { "bbox": { "h": 0.018, "w": 0.368, "x": 0.117, "y": 0.093 }, "kind": "title", "text": "Captured Data Communications", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.517+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f253e0ee-aca0-4ddf-8664-1aee3542325e", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 75, "type": "appendix", "title": "Contains two Wireshark screenshots demonstrating data exfiltration of IMSI/IMEI and browsing history.", "function": "analyze_data", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "dense", "densityScore": 53, "componentCount": 8, "textChars": 980, "nDataPoints": 0, "notes": "Contains two Wireshark screenshots demonstrating data exfiltration of IMSI/IMEI and browsing history.", "elementsJson": [ "paragraph", "screenshot" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:46.124+00", "seconds": 7.506, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/75", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-75", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "It means that the provider, and anyone that is \"sniffing\" the network has the ability to track the users and obtain all browsing habits of the user, and even in some cases get information that is much more critical such as usernames and password and session ids if they are transferred in the URL.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:58+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab11-329b05f515fc", "parentComponentId": null }, { "bbox": { "h": 0.28, "w": 0.78, "x": 0.11, "y": 0.17 }, "kind": "image", "text": "Wireshark capture of XML request", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:46.124+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "41f21fcc-fc93-4cf1-a250-928825229c3b", "parentComponentId": null }, { "bbox": { "h": 0.28, "w": 0.78, "x": 0.11, "y": 0.65 }, "kind": "image", "text": "Wireshark capture of URL leakage", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:46.124+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "eee086b4-9f96-47db-a80b-d29c7842ee38", "parentComponentId": null }, { "bbox": { "h": 0.08, "w": 0.78, "x": 0.11, "y": 0.51 }, "kind": "paragraph", "text": "It was discovered that the app sends every URL that is browsed in the device to a remote server located in China (211.151.74.173). The connection through which the data is sent is not encrypted, but rather obfuscated with an easily reversible method of XOR the URL with 0x6e.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:46.124+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "30f55716-724a-46d9-83b8-cddceabc55da", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.45, "x": 0.11, "y": 0.48 }, "kind": "paragraph", "text": "App leaks all the web browsing activities of the user:", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:46.124+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "4fa9ec1d-b872-41f3-8c4e-c3da95fdf344", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "paragraph", "text": "sends a plain-text request which contains among other things the IMSI and IMEI inside a readable XML format.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:46.124+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "8e248449-845f-4ae8-a6ff-864cbbe94f8e", "parentComponentId": null }, { "bbox": { "h": 0.02, "w": 0.55, "x": 0.11, "y": 0.14 }, "kind": "paragraph", "text": "This communication is delivered to NQ's servers - us.nqserv.com (211.151.59.8)", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:46.124+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9610f451-67d8-4de9-ad14-675b5cc6168e", "parentComponentId": null }, { "bbox": { "h": 0.03, "w": 0.78, "x": 0.11, "y": 0.62 }, "kind": "paragraph", "text": "We have tested the effectiveness of the URL tester and it indeed detects malicious pages, and blocks it.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:46.124+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "f3dfe003-4a13-4b09-a4f1-d762dcae95bb", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 76, "type": "appendix", "title": "Includes Python code snippet for decryption logic.", "function": "analyze_data", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "balanced", "densityScore": 48, "componentCount": 7, "textChars": 1115, "nDataPoints": 0, "notes": "Includes Python code snippet for decryption logic.", "elementsJson": [ "paragraph", "bullet_list", "screenshot" ], "confidence": 1, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:42.86+00", "seconds": 4.172, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/76", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-76", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": { "h": 0.075, "w": 0.535, "x": 0.118, "y": 0.313 }, "kind": "list", "text": "The data sent from the App to server: 10bytes 'newversion' XORed with 0x6e. 16bytes of encryption key XORed with 0x6e. Data encrypted with AES using the key just before it.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:42.86+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "388af703-b7a8-4f82-bdd1-b72fc653dfdd", "parentComponentId": null }, { "bbox": { "h": 0.045, "w": 0.535, "x": 0.118, "y": 0.415 }, "kind": "list", "text": "The data sent from the server to App: 16bytes of encryption key XORed with 0x6e. AES data following.", "attrs": null, "canon": { "kind": { "name": "List", "slug": "list", "status": "active", "canonId": "019de52c-f94b-779b-a53b-fd4904a5f4d2", "version": 1, "description": "Bullet or numbered list." }, "tool": null, "subkind": { "name": "Bullet list", "slug": "bullet", "status": "active", "canonId": "019de52c-fc98-7169-a083-5cab805076ca", "version": 1, "description": null }, "framework": null }, "subkind": "bullet", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:42.86+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "eacf504c-905f-429f-bab7-343a91517caa", "parentComponentId": null }, { "bbox": { "h": 0.085, "w": 0.763, "x": 0.118, "y": 0.092 }, "kind": "other", "text": ">>> c = \"\"\n>>> a = \"75726c3d061a1a1e5441411919401a060b1d0b0d1c0b1a400d010341511e0f1d1d19011c0a535f5c5d5a\".decode(\"hex\")\n>>> for i in a[4:]:\n... c += chr(ord(i)^0x6e)\n\n>>> c\n'http://www.thesecret.com/?password=1234'\n>>>", "attrs": null, "canon": { "kind": { "name": "Other", "slug": "other", "status": "active", "canonId": "019de52c-fa90-743c-8bf6-20d1fbe82b6d", "version": 1, "description": "Fallback when no canonical kind applies." }, "tool": null, "subkind": { "name": "Unclassified", "slug": "unclassified", "status": "active", "canonId": "019de52d-05ca-77db-81fb-db7d4234bbc0", "version": 1, "description": null }, "framework": null }, "subkind": "unclassified", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:42.86+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "601c350b-c670-425b-a6a9-55d14dfdf86f", "parentComponentId": null }, { "bbox": { "h": 0.045, "w": 0.763, "x": 0.118, "y": 0.498 }, "kind": "paragraph", "text": "The content of the encrypted data is in XML format. It contains commands that look similar to the previously described XML in the plain-text communications. The command is an integer value that indicates the indicator \"type\" of command rather than a \"exec-command\".", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:42.86+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "907de1ec-3c14-43ec-8eb9-9348f6858a28", "parentComponentId": null }, { "bbox": { "h": 0.015, "w": 0.535, "x": 0.118, "y": 0.281 }, "kind": "paragraph", "text": "The request is an HTTP POST request to 'boss-cs-av-v4/app.htm.'", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:42.86+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "add048c1-7acb-4ec1-989a-c638ee2a9659", "parentComponentId": null }, { "bbox": { "h": 0.045, "w": 0.763, "x": 0.118, "y": 0.218 }, "kind": "paragraph", "text": "The most visible part of the app is the 'Update virus database' button, this button is in charge of asking the user for a payment. When clicked it makes the application communicate with a server owned by NQ at ms-cm.nqsecurity.com (211.151.59.57) and sends encrypted data.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:42.86+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "d17f541d-59c6-4fd1-8cff-01a51d0dc845", "parentComponentId": null }, { "bbox": { "h": 0.015, "w": 0.287, "x": 0.118, "y": 0.188 }, "kind": "title", "text": "Update virus database", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:42.86+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "6b87a354-0b3a-4425-b86f-9f84bcc8a472", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 77, "type": "appendix", "title": "The slide displays a network traffic analysis (Wireshark) and the decoded XML payload from a server, likely used to demonstrate malware behavior or communicatio", "function": "illustrate_case", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "illustrate_case", "functionCanon": { "name": "Illustrate case", "slug": "illustrate_case", "status": "active", "canonId": "019de52d-13b4-772c-bb73-1873612a7463", "version": 1, "description": null }, "density": "sparse", "densityScore": 4, "componentCount": 2, "textChars": 131, "nDataPoints": 0, "notes": "The slide displays a network traffic analysis (Wireshark) and the decoded XML payload from a server, likely used to demonstrate malware behavior or communication protocols.", "elementsJson": [ "screenshot" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:40.549+00", "seconds": 1.855, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/77", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-77", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": { "h": 0.35, "w": 0.9, "x": 0.05, "y": 0.05 }, "kind": "image", "text": "Wireshark packet capture window showing HTTP traffic to ms-cn.nqsecurity.com", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:40.549+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "3a5c604e-c0dc-4405-af87-a24fa9798475", "parentComponentId": null }, { "bbox": { "h": 0.55, "w": 0.9, "x": 0.05, "y": 0.4 }, "kind": "image", "text": "Python Shell window displaying XML server response data", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:40.549+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "579585d9-c080-458f-9c73-8732f8644e40", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 78, "type": "appendix", "title": "The slide contains a screenshot of an XML response from a server, with specific fields highlighted (BOKU chargeId, Price, Currency).", "function": "analyze_data", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "analyze_data", "functionCanon": { "name": "Analyze data", "slug": "analyze_data", "status": "active", "canonId": "019de52d-1590-7413-8c82-cc218cff40b4", "version": 1, "description": null }, "density": "dense", "densityScore": 56, "componentCount": 8, "textChars": 1125, "nDataPoints": 0, "notes": "The slide contains a screenshot of an XML response from a server, with specific fields highlighted (BOKU chargeId, Price, Currency).", "elementsJson": [ "paragraph", "screenshot" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:45.649+00", "seconds": 6.931, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/78", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-78", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "The idea is to show that we got code execution on the device and so does NQ.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:58+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab11-5f41bc96246a", "parentComponentId": null }, { "bbox": { "h": 0.505, "w": 0.764, "x": 0.118, "y": 0.186 }, "kind": "image", "text": "Python Shell window showing XML response data", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:45.649+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "88401503-97db-4bd6-b048-ed816a01289d", "parentComponentId": null }, { "bbox": { "h": 0.022, "w": 0.425, "x": 0.118, "y": 0.751 }, "kind": "paragraph", "text": "Goal: Determine if app allows remote code execution.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:45.649+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "7011111d-df43-4431-9c80-7e5df5462204", "parentComponentId": null }, { "bbox": { "h": 0.035, "w": 0.764, "x": 0.118, "y": 0.093 }, "kind": "paragraph", "text": "In response to this request, the server returns a response indicating the applications payment state. It indicates whether the user paid already for enabling some features.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:45.649+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "81b67b49-4d52-4b3a-935f-8b9605057fd9", "parentComponentId": null }, { "bbox": { "h": 0.065, "w": 0.764, "x": 0.118, "y": 0.781 }, "kind": "paragraph", "text": "Process: Research the software update, request update from the server, and get a response. In this response, we saw there’s a command value. We looked in the code and saw that there’s another special command that is being processed which directs the application to download a file from the server or any address!", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:45.649+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "96e3e89e-037c-4840-9a5a-dc1b0ae5efbc", "parentComponentId": null }, { "bbox": { "h": 0.035, "w": 0.764, "x": 0.118, "y": 0.143 }, "kind": "paragraph", "text": "It also specifies with which payment provider it should request payment from, and the amount of money. We saw Boku and Google wallet as providers.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:45.649+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "9d138de7-9b04-4318-b7c2-09f9d1dfa8a1", "parentComponentId": null }, { "bbox": { "h": 0.065, "w": 0.764, "x": 0.118, "y": 0.861 }, "kind": "paragraph", "text": "At that point of the research we set up an experiment where we did man-in-the-middle attack on the device, technically we edited the hosts file so the NQ server so that they will point to our HTTP server instead of NQ’s one. The idea is to show that we got code execution on the device and so does NQ.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:45.649+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "fe551db5-b28b-4893-ab55-8212e4b67acd", "parentComponentId": null }, { "bbox": { "h": 0.022, "w": 0.235, "x": 0.118, "y": 0.721 }, "kind": "title", "text": "Remote Code Execution", "attrs": null, "canon": { "kind": { "name": "Title", "slug": "title", "status": "active", "canonId": "019de52c-f7dd-76d9-b848-b1f12bd85cf4", "version": 1, "description": "Slide title or headline." }, "tool": null, "subkind": { "name": "Headline", "slug": "headline", "status": "active", "canonId": "019de52c-fae1-7463-9a7c-d60668eced0d", "version": 1, "description": null }, "framework": null }, "subkind": "headline", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:45.649+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "141e4ec8-19ae-4fa4-a005-1367bf90a1f4", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 79, "type": "appendix", "title": "This appears to be a technical research note detailing a malware delivery or software deployment mechanism.", "function": "plan_implementation", "rawType": "other", "block": null, "metadata": { "slideType": "other", "slideTypeCanon": { "name": "Other (fallback)", "slug": "other", "status": "active", "canonId": "019de52d-0af5-71ed-83de-d51ae245fc43", "version": 1, "description": null }, "function": "plan_implementation", "functionCanon": { "name": "Plan implementation", "slug": "plan_implementation", "status": "active", "canonId": "019de52d-14a2-77ea-b210-d6a95eed4823", "version": 1, "description": null }, "density": "sparse", "densityScore": 15, "componentCount": 3, "textChars": 617, "nDataPoints": 0, "notes": "This appears to be a technical research note detailing a malware delivery or software deployment mechanism.", "elementsJson": [ "paragraph" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:41.77+00", "seconds": 2.892, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/79", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-79", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "Basically the file the protocol describes is supposed to be an .APK file. This file is later chmod'ed to become r+x so it could be executed later.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:59+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab11-bf1cea17b90f", "parentComponentId": null }, { "bbox": { "h": 0.153, "w": 0.764, "x": 0.118, "y": 0.093 }, "kind": "paragraph", "text": "On our HTTP server we set up a response according to what we saw that the application expects. The response contains a different command value, which indicates to the client that it should download a file, and the URL of the file to download. Basically the file the protocol describes is supposed to be an .APK file. This file is later chmod'ed to become r+x so it could be executed later.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.77+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "08d3288d-504f-4e3a-950b-e62a9dd40159", "parentComponentId": null }, { "bbox": { "h": 0.019, "w": 0.703, "x": 0.118, "y": 0.174 }, "kind": "paragraph", "text": "The application was properly installed but requires approval by user intervention.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.77+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "1eddf05e-b81f-4e02-be9d-4fa270032899", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [ { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 80, "type": "evidence", "title": "The slide documents a user flow for updating an application, highlighting the permissions requested during installation.", "function": "illustrate_case", "rawType": "customer_journey", "block": null, "metadata": { "slideType": "customer_journey", "slideTypeCanon": { "name": "Customer journey", "slug": "customer_journey", "status": "active", "canonId": "019de52d-0966-70ce-afe3-bc7c98ffc8c9", "version": 1, "description": null }, "function": "illustrate_case", "functionCanon": { "name": "Illustrate case", "slug": "illustrate_case", "status": "active", "canonId": "019de52d-13b4-772c-bb73-1873612a7463", "version": 1, "description": null }, "density": "sparse", "densityScore": 3, "componentCount": 1, "textChars": 113, "nDataPoints": 0, "notes": "The slide documents a user flow for updating an application, highlighting the permissions requested during installation.", "elementsJson": [ "screenshot" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:40.764+00", "seconds": 1.792, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/80", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-80", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": { "h": 0.87, "w": 0.78, "x": 0.11, "y": 0.09 }, "kind": "image", "text": "Three mobile screenshots showing app update flow: progress bar, completion dialog, and permission request screen.", "attrs": null, "canon": { "kind": { "name": "Image", "slug": "image", "status": "active", "canonId": "019de52c-f978-701f-a720-51d029d769e7", "version": 1, "description": "Photo, illustration, screenshot or icon." }, "tool": null, "subkind": { "name": "Screenshot", "slug": "screenshot", "status": "active", "canonId": "019de52c-fd87-7509-8391-3d79fb339379", "version": 1, "description": null }, "framework": null }, "subkind": "screenshot", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:40.764+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "49b5a8be-e2bf-4021-943a-08727a1cd66e", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [ { "matchId": "2aee1d4f-1467-434c-a255-cee7689345bf", "evidence": "The slide depicts a sequential user experience flow for an app update process.", "framework": null, "confidence": 0.8, "extraction": { "at": "2026-05-02 20:51:40.764+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "pageNumber": 80, "frameworkName": "customer-journey-map" } ], "arcBeats": [ { "to": 80, "arc": { "name": "Overcoming the Monster", "slug": "overcoming-monster", "status": "active", "bestFor": "Competitive positioning, rallying teams", "canonId": "019dd956-6339-76ac-9cbf-4b377c3aa89e", "version": 1, "bodyDocId": "019df22a-2356-73eb-8061-d8c81dc0aa49", "structure": "The Monster -> The Call -> The Struggle -> The Victory -> The New Order", "description": null, "familyLabel": null }, "from": 61, "name": "Appendix Data", "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878", "matchId": "1e7dea38-9f5a-489f-8cfb-8c68b2dfc2c7", "beatType": null, "evidence": "The document provides extensive data and evidence to support its claims.", "position": 2, "isPrimaryArc": true, "parentBeatType": null, "alignedBlockIds": null, "matchConfidence": 0.8 } ], "loops": [], "locked": true }, { "page": 81, "type": "analysis", "title": "This appears to be a concluding page of a security research report detailing a specific exploit path.", "function": "diagnose_problem", "rawType": "appendix_disclosure", "block": null, "metadata": { "slideType": "appendix_disclosure", "slideTypeCanon": { "name": "Appendix disclosure", "slug": "appendix_disclosure", "status": "active", "canonId": "019de52d-07b2-7549-8e8b-932a19f6e616", "version": 1, "description": null }, "function": "diagnose_problem", "functionCanon": { "name": "Diagnose problem", "slug": "diagnose_problem", "status": "active", "canonId": "019de52d-176d-761f-b608-cf52262d2ab2", "version": 1, "description": null }, "density": "balanced", "densityScore": 30, "componentCount": 5, "textChars": 915, "nDataPoints": 0, "notes": "This appears to be a concluding page of a security research report detailing a specific exploit path.", "elementsJson": [ "paragraph" ], "confidence": 0.9, "extraction": { "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "at": "2026-05-02 20:51:41.806+00", "seconds": 2.664, "promptVersion": "v2-canon-conditioned" } }, "links": { "slide": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/81", "deck": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78", "deckAnchor": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-81", "deckJson": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json" }, "components": [ { "bbox": null, "kind": "callout", "text": "This technically leads to remote code execution on the device.", "attrs": null, "canon": { "kind": { "name": "Callout", "slug": "callout", "status": "active", "canonId": "019de52c-f8d3-761a-8953-7d37080de5e2", "version": 1, "description": "Highlighted callout box." }, "tool": { "name": "Visual emphasis", "slug": "visual-emphasis", "status": "active", "bestFor": null, "canonId": "019dd9e1-474b-736b-a8eb-a794dd88241c", "version": 1, "bodyDocId": null, "description": "Drawing the eye to one element above the rest of the slide.", "familyLabel": null }, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-04-22 23:10:59+00", "model": "unknown-legacy", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "019dd953-0936-7173-ab12-463ef65807d0", "parentComponentId": null }, { "bbox": { "h": 0.041, "w": 0.764, "x": 0.118, "y": 0.223 }, "kind": "paragraph", "text": "The fact that the app is not using standard encryption is very odd especially when dealing with a company that is providing security products. Using standard SSL encryption could have prevented (or at least make it fairly impractical) this risk and others.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "06f4bf71-160b-4146-8e00-2bc9da8c1b09", "parentComponentId": null }, { "bbox": { "h": 0.055, "w": 0.764, "x": 0.118, "y": 0.094 }, "kind": "paragraph", "text": "Later on, we decided to go further and see whether we could override existing files and bypass the user intervention to get rid of the message box. We found out that if we change the returned XML without the message related fields, then no message box is displayed for the user.", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "294bbc9f-46ae-4826-bf46-c79816846326", "parentComponentId": null }, { "bbox": { "h": 0.055, "w": 0.764, "x": 0.118, "y": 0.158 }, "kind": "paragraph", "text": "This technically leads to remote code execution on the device. We have to emphasis that this is not a vulnerability in the code, in contrary, this is part of a normal flow control of the code and can be easily exploited to push files to the device which are controlled by the server and could be malicious!", "attrs": null, "canon": { "kind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "5f2affc0-941d-4d07-959d-4bfc1930cea4", "version": 1, "description": "Single prose block in the body of a slide." }, "tool": null, "subkind": { "name": "Paragraph", "slug": "paragraph", "status": "active", "canonId": "019de52c-fb80-75af-aa5c-a7a4bfac2433", "version": 1, "description": null }, "framework": null }, "subkind": "paragraph", "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "ef91b7a6-dbc2-4598-ad9b-3c280f03c52a", "parentComponentId": null }, { "bbox": { "h": 0.014, "w": 0.072, "x": 0.81, "y": 0.955 }, "kind": "source-note", "text": "Page 81 of 81", "attrs": null, "canon": { "kind": { "name": "Source note", "slug": "source-note", "status": "active", "canonId": "23484952-494b-4a5e-b1ad-550d0d70e948", "version": 1, "description": "Attribution / source / caveat placed at the slide footer. Numbered footnotes use attrs.numbered." }, "tool": null, "subkind": null, "framework": null }, "subkind": null, "groupRole": null, "confidence": null, "extraction": { "at": "2026-05-02 20:51:41.806+00", "model": "google/gemini-3.1-flash-lite-preview-20260303", "runId": null, "seconds": null, "promptVersion": null }, "componentId": "b43d034e-37c2-42ae-80c7-e8c47f3beea6", "parentComponentId": null } ], "metrics": [], "tools": [], "frameworks": [], "arcBeats": [], "loops": [], "locked": true } ], "arcBeats": [ { "from": 6, "to": 15, "label": "Expose Contradiction", "description": "The document presents several contradictions in NQ Mobile's financials and business practices." }, { "from": 3, "to": 5, "label": "Villain Critique", "description": "The document critiques NQ Mobile's management and business practices." }, { "from": 61, "to": 80, "label": "Appendix Data", "description": "The document provides extensive data and evidence to support its claims." } ], "loops": [] }