Extract an App's Icon from an EXE with PowerShell

Use the forgotten Icon.ExtractAssociatedIcon .NET method to rip an executable's icon out to a PNG file.

Windowsiconsystem-drawingpowershellLow risk

Call [System.Drawing.Icon]::ExtractAssociatedIcon on the exe path, convert with ToBitmap(), and save as PNG.

01Command

Command

$ Add-Type -AssemblyName System.Drawing; $ico=[System.Drawing.Icon]::ExtractAssociatedIcon('C:\Windows\System32\notepad.exe'); $ico.ToBitmap().Save('C:\temp\notepad-icon.png',[System.Drawing.Imaging.ImageFormat]::Png)

02What it does

Windows embeds every app's icon inside its executable, and ExtractAssociatedIcon reads it back without any resource editor. The method only returns the 32x32 size — for larger or multi-size icons you would need raw resource extraction — but 32px is enough for docs, READMEs, and shortcuts. ToBitmap converts it into a normal image you can save in any GDI+ format.

03Risk

RiskLow risk

RequirementsWindows PowerShell 5.1 (System.Drawing requires .NET Framework); ExtractAssociatedIcon returns only the 32x32 variant

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

Icon.ToBitmap Method (System.Drawing)
Microsoft Learn · vendor-doc · 2026-09-17
Evidence: Documents converting the extracted Icon into a Bitmap so it can be saved as PNG or another image format.
Icon.ExtractAssociatedIcon Method (System.Drawing)
Microsoft Learn · vendor-doc · 2026-09-17
Evidence: Documents extracting the icon image contained in an executable file, and notes the returned icon is 32x32 pixels.

Last verified: 2026-09-17 · Category: Media

06Related solutions

Grep on Windows: Select-String

Windowssearchtextpowershell

Search inside text files and logs with regex, returning file, line number and match.

Low risk ✓ 2026-09-17

Zip Files with Compress-Archive

WindowsZip & Archivesarchivepowershell

Create or update a .zip from any files or folder contents straight from PowerShell.

Low risk ✓ 2026-09-17

Test a TCP port connection on Windows with Test-NetConnection

Windowsnetworktroubleshootingpowershell

A built-in PowerShell one-liner that answers 'is port 5432/3389/443 actually open through this network?' — no telnet client needed.

Low risk ✓ 2026-09-17