Encrypted payload and empty JSON object (EM300-TH)

I’ve connected EM300-TH sensor to Chirpstack server and everything works correctly but I receive wrong/encrypted payload data.
I tried Cayenne LPP codec and this custom codec which was recommended in Milesight EM300-TH manual, but none of these works - both returns an empty JSON object and payload data is not correct.
For example I receive
IK5rA/8iJQ==
which in hex is
20 ae 6b 03 ff 22 25
but from EM300-TH manual I should receive something like this:
em300th0
As I have looked, the first two bytes have never been 01-06.

I’ve tried “json” and “json_v3” payload marshalers.

My question is how exactly the payload is encrypted and maybe an advice how to decrypt EM300-TH data? Or maybe there is a way to not encrypt payload at all?

In addition, I have tried Milesight IoT Cloud and there payload data was in correct form, so the device works correctly.

Thanks

It started working when I changed marshaler to “protobuf” with custom Milesight decoder.

Nevermind, changing lorawan version from 1.1.1 to 1.0.2 made it work. Even for the uc1114 which has version 1.1.1 in the specs. It works with both json and protobuf marshaler