last - @last0x00

This should be fixed in 1.16.1 which I just released and seems to catch the use case :) @j-wsy @strassi

Yes, the encoded base64 is the SD that's generated by GhostTask, but I'll look into your suggestion as it makes sense only to look for that specific part potentially.

To add to that, I'll check and see which part of the SD is mandatory so that manipulation attempts of the SD do not result in evasion.