The silent install, documented to the second.

Summary of findings

• On September 30, 2025, with an LG UltraGear 27GR83Q connected, Windows Update delivered two LG packages of class Extension and SoftwareComponent. Neither contains driver code.
• The packages install LGElectronics.LGMonitorApp from the Microsoft Store under SYSTEM, about 32 seconds after delivery. No prompt, no EULA, no entry in the classic programs list.
• The monitor was disconnected in mid-October 2025. The app remained, and self-updated as SYSTEM on July 9, 2026, nine months later.
• Both LG packages remain in the Windows driver store, wired to 51 hardware IDs across 19 monitor models. Uninstalling the app alone leaves the machine armed.
• Both packages are signed "Microsoft Windows Hardware Compatibility Publisher." The machine was on stock default policy. This is the out-of-box Windows experience.

The machine

• Host: REDACTED (Windows 11, stock default device-installation policy)
• OS baseline: REDACTED
• Trigger device: LG UltraGear 27GR83Q (manufacturer and product IDs retained in evidence; serial descriptor and numeric serial withheld)
• Other displays present: seven other panels from three brands were recorded on this install; none triggered any software delivery.

The install chain, to the second

Reconstructed from Windows Update, CBS/servicing, Store install-service, and Reliability Monitor logs. A small clock offset between log sources was measured and accounted for; the ordering below is unaffected.

• 9:52 PM — Windows Update delivers two LG packages for the connected UltraGear: an Extension INF and a SoftwareComponent INF. Neither carries driver binaries.
• ~9:52 PM — The Extension package fabricates a phantom child device under the monitor. Its only purpose is to give the SoftwareComponent package something to bind to.
• ~9:53 PM (about 32 seconds later) — The SoftwareComponent package's directive fires, and Windows fetches LGElectronics.LGMonitorApp from the Microsoft Store. The app is installed by SYSTEM.
• Next logon — The app is registered into the user account. No installer window, no consent dialog, no uninstall entry in the classic Programs and Features list ever appears.

The two packages

Both come from provider LG Electronics Inc., package dated August 27, 2024, WHQL-signed and co-signed by Microsoft. In the driver store they appear as:

• lgmonitorappextension.inf — class Extension. Contains no driver code. It fabricates a phantom child device so a companion package has a binding target.
• lgmonitorappsoftwarecomponent.inf — class SoftwareComponent. Contains no driver code. It carries the single directive that delivers the app.

The delivery directive lives in the SoftwareComponent INF: an AddComponent entry with SoftwareType = 2, the INF form that tells Windows to install a specific Microsoft Store app for the device. The target is LGElectronics.LGMonitorApp. That is the whole mechanism: a "driver" whose only job is to make Windows install an app.

The full INF text and the complete signing chain are preserved in the evidence set.

Consent surfaces: none

We looked specifically for the points where a user could have seen or approved this. There were none:

• No installer window or progress UI at install time.
• No EULA or terms prompt before the app was placed.
• No entry in the classic Programs and Features uninstall list (the app is only visible under Settings → Apps → Installed apps).
• The delivery ran under SYSTEM, not the user, so nothing was gated on a user click.

Persistence is active, and Windows does the maintaining

The panel was unplugged in mid-October 2025. The app was not.

• App version chain on this machine: 1.2405.3001.0 (installed Sep 2025) → 1.2602.502.0 → 1.2606.1601.0.
• July 9, 2026, 2:11 AM — the app self-updates to 1.2606.1601.0, staged by SYSTEM. Nine months after the monitor left.
• July 15, 2026 — Device Setup Manager is still re-staging the orphaned monitor's metadata.
• July 17, 2026 — the Microsoft Store install service touches the app again.

Uninstalling the app alone does not end this. Both LG packages stay in the driver store, and reconnecting any listed LG panel re-arms the chain. Full removal is in the fix.

The trigger list

The resident LG extension package wires 51 hardware IDs across 19 monitor models for automatic app delivery. The models:

Each model maps to one or more hardware IDs (monitor + hub/companion enumerations), 51 in total; the complete hardware-ID table is preserved in the evidence set. Note what is absent: the models driving the news cycle, UltraGear 34GX900A-B, 27GP83B, 27GN800 and UltraFine 32UN880-B, do not appear in this revision of the package. LG ships multiple revisions with different coverage, so the real footprint is larger than any single list, ours included.

What is not affected

• Every non-LG display on this machine. Seven other panels from three brands were present across this install. None triggered any software delivery.
• Dell, as a direct contrast. The Dell S2716DG's package arrived through the same Windows Update channel, and it is a normal monitor driver with no app payload. Same delivery road, ordinary cargo. This is what a benign monitor package looks like, and it is what LG's is not.

Verify it yourself

This machine was not cleaned; it is held as evidence. If you can reproduce or refute any step, we want to see it. Reports we're collecting, and the PowerShell to read your app version, are on the main page.