It's my guess.
We list a files and directory by Windows Explorer. If Windows Explorer meets a exe file, it does,
LoadLibraryEx(ExefileName, LOAD_LIBRARY_AS_DATAFILE)
Then extracts the icon, and represents it.
But I'm not sure. Is there anyone who knows well about this?
I'm finding a nice case with LOAD_LIBRARY_AS_DATAFILE
Is there anything else you know?