OwaAuth uses the filename owaauth.dll, which is a legitimate file that normally resides in "%ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\Auth\"; the malicious file by the same name is saved in "%ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\bin\".