Live Investigation
CFX Export
CLASSIFIED
TLP:RED
Module 03

Sequence of Events

Cross-channel correlation: chat → system alteration → cash extraction.

Chronological Reconstruction
  1. Communication
    2024-03-04 09:12· Imran → Zubair
    Plot: redirect HMB receivables

    "Route the HMB cheque via the new account before Friday filing."

  2. System Event
    2024-03-04 11:47· SRB Portal
    Filing record edited

    Withholding tax line item for INV-2024-1043 silently zeroed via admin session.

  3. Bank Event
    2024-03-05 10:02· Dilawar Khan
    Cash withdrawal — PKR 1,950,000

    ATM + counter split across 3 branches within 41 minutes.

  4. Communication
    2024-03-12 18:31· Zubair → Dilawar
    Mule logistics

    "Use the Korangi branch tomorrow. Keep each pull under the CTR limit."

  5. System Event
    2024-03-13 09:55· ERP (SAP)
    Vendor master altered

    Fake vendor 'Crescent Trade Solutions' added with bank account ending 7741.

  6. Bank Event
    2024-03-13 14:20· Account ****7741
    Inbound transfer — PKR 3,420,000

    Marked as 'vendor settlement' against forged invoice CTS-0019.

  7. Communication
    2024-03-20 22:08· Imran (UBO)
    Ownership filing

    "Submit the share transfer overnight — registrar contact is handled."

  8. System Event
    2024-03-21 02:14· SECP Filing
    UBO record overwritten

    Beneficial ownership reassigned to nominee 'A. Qureshi' — original directors not notified.

  9. Bank Event
    2024-03-21 11:09· Dilawar Khan
    Cash withdrawal — PKR 2,400,000

    Bearer cheque cashed at MCB main branch.