AutoOpen macro

AutoOpen runs automatically when a Word document is opened. This is a capability/context marker — it tells you the macro runs without further interaction — not evidence of malice on its own; legitimate macro documents use it routinely. Rated low: a malicious document still convicts via its actual payload signal (Shell/download/LOLBin), so the auto-exec trigger is a corroborating context cue, not a standalone flag.