I have recently been doing some security evaluation work on our Android applications, by proxying all the communication through Burp Suite.
I noticed one of our devices was sending requests to a domain I did not recognise, one that is registered in China. It turns out the application sending these requests is a file manager app that came pre-installed on the device (cheap Chinese tablet).
It mostly seems to send requests when the application is in use, though occasionally appears to send requests in the background too. The app doesn't display adds or related content so it isn't that, also when it does load content such as help, it comes from a different domain. My suspicion is it is posting some sort of tracking or snooping data.
I am obviously concerned and curious as to what data this application is sending but I am struggling to work out the payloads. The headers do not indicate a content type, I have used all of the decoders in Burp Suite to no avail. Firstly I considered binary and gzip but I end up with the same data, I've also attempted to convert the data to Chinese with zero success.
If anyone can shed any light on my next steps to decoding this request content, that would be much appreciated.
Here's the request / response screenshots