Got it, some DDL and DML sent by the sofware vendor, isn't it?

Do you want to be safe?

After the app upgrade just shutdown the database, cleanly - then take another cold backup like the first one you took.