In which of the following locations would a forensic analyst look to find a hooked process?

In which of the following locations would a forensic analyst look to find a hooked process?

A.
BIOS

B.
Slack space

C.
RAM

D.
Rootkit