This is the relevant part of the data from the capture:

Data sent:
POST /ota/httpif HTTP/1.1
Hos!NC#0211aaCuybayqeiGkE30/xZokM

Data received:
HTTP/1.1 200 OK
Content-Trans!NC#0111aaC2SCk23840l184bsq+60


No surprise that the contents are encrypted, but I though the communication were going to be much more complicated, looks like the message is small.

I would say that the next step is to detect the changes made in the storage of the device after activating. This would give us a key or something that might be directly related with the received data.