Rundll32 Invokes DAEMON Tools mcrypto Cleanup Exports

Detects rundll32 executing the unusual mcrypto.chiper or mcrypto_clean exports. The misspelled export naming is tied to the compromised DAEMON Tools post-installation stage, indicating potential malicious activity related to the DAEMON Tools backdoor.