The discussed malware scrapes data out of memory and sends it to a central repository system. IP address tracking helps to determine which accounts the malware is owned by and what systems they are communicating with.