While hunting, I found an interesting picture. It's a PNG file that was concatenated with two interesting payloads. There are file formats that are good candidates to have data added at the end of the file. PNG is the case because the file format specifications says:
You must log in or # to comment.
deleted by creator
Yes. And you will have a good chance that the EDR wont flag the extractor since its not suspicious code per se.