Here is frosting.
Its counterpart is localappstate.db.
For frosting.db, you need to have a root or physical access
to the device.
It shows you the full path where the app is installed,
the last update time, and also the name of the app.
So anything that is sideloaded, meaning
downloaded from the internet or put onto the device
from another location, possible malware, ransomware, anything
that's existing, this will be a good file
to look at if you have access to it.