The first four bytes of the data field should be the function selector. The function selector is the first four bytes of the keccak-256 hash of the canonical function signature. In this case, keccak256("transfer(address,uint256)") (0xa9059cbb).

The next 32 bytes should be the address (left-padded) you're transferring to, and the 32 bytes after that should be the amount.

The first four bytes of the data field should be the function selector. The function selector is the first four bytes of the keccak-256 hash of the canonical function signature. In this case, keccak256("transfer(address,uint256)") (0xa9059cbb).

The next 32 bytes should be the address (left-padded) you're transferring to, and the 32 bytes after that should be the amount.

EDIT

Based on further questions in the edited question.

1. It looks like you're using SHA3 instead of keccak-256.
2. I'm not sure what your question here is.
3. 0x7530 == 30000. If that's "3" tokens, then the token is using four decimal places. (3 * 10^4 == 30000 == 0x7530.)