$ 0 0 Chances are it sends email during down time (a guess). Therefore you may find something in volatile-related places (page file, hybersys).