Didier Stevens added a JSON output mode to his onedump.py tool, so you no longer have to run it once per embedded file when triaging OneNote attachments. Run onedump.py --jsonoutput *.one to analyze many .one files in one go, and pipe it into myjson-filter.py -W hashvir to write every embedded file to disk named by the SHA-256 of its content plus .vir.

Why it helps: the hash-based names dedupe identical payloads across a campaign and give you hashes ready to search in your EDR or threat-intel platform. Do this in an isolated analysis VM, since the extracted files are live malware.