where to llok for a hooked process

In which of the following locations would a forensic analyst look to find a hooked process?