_________ is a tool that can hide processes from the process list, can hide files, registry entries, and intercept keystrokes.

A Trojan disguises itself as a legitimate application to deliver a malicious payload but does not provide the kernel-level hiding and hooking capabilities that define a rootkit.

Rootkits function at ring 0 or kernel level, intercepting and modifying OS API calls so that malicious processes, files, and registry keys are filtered from the output seen by administrators and security software, while simultaneously logging keystrokes without user awareness.

A DoS tool is designed to exhaust system or network resources and deny service to legitimate users, not to hide itself or capture keystrokes.

A scanner probes hosts for open ports, services, or vulnerabilities; it does not conceal processes or intercept OS-level activity.

A backdoor establishes a covert channel for unauthorized remote access but does not specifically hide entries from the process list or perform keystroke interception at the OS level.