https://unit42.paloaltonetworks.com/payloads-in-malicious-onenote-samples/