http://{blocked}ejae.ru/bin/sa ejuogi.bin

This is where TSPY_ZBOT.BWF downloads its configuration file. This configuration file contains the list of targeted banks, where it can download an updated copy of itself and where to send the stolen information.