Have a look at the last 4 bytes of the 160h payload where the c8 is found. I found 2 different 4-byte blocks:
bf 77 58 cb
bf 30 48 cb
If you now follow the rule which applies for stream cipher
crypt1 xor crypt2 = plain1 xor plain2
and assuming that plain2=00 00 00 00
you see the following:
(bf 77 58 cb) xor (bf 30 48 cb) = 00 47 10 00
Without having the key, you see that one header of the plaintext is 47 10 00 xx.
Knowing that T2-MI streams usually are within pid 0x1000 (4096) we can assume that this stream most probably is a T2-MI stream
bf 77 58 cb
bf 30 48 cb
If you now follow the rule which applies for stream cipher
crypt1 xor crypt2 = plain1 xor plain2
and assuming that plain2=00 00 00 00
you see the following:
(bf 77 58 cb) xor (bf 30 48 cb) = 00 47 10 00
Without having the key, you see that one header of the plaintext is 47 10 00 xx.
Knowing that T2-MI streams usually are within pid 0x1000 (4096) we can assume that this stream most probably is a T2-MI stream