first 3 bytes decrypted