Which of the following types of rootkits replaces regular application binaries with Trojan fakes and modifies the behavior of existing applications using hooks, patches, or injected code?

Application-level rootkits target the user-space layer by replacing genuine executables with malicious Trojan versions, and they use API hooks, binary patches, or DLL/shared-library injection to intercept and manipulate the behavior of running applications while appearing legitimate to casual inspection.

Hypervisor rootkits load beneath the operating system at the virtualization layer to intercept hardware-level calls, not by replacing user-space application binaries.

Kernel-level rootkits modify OS kernel code or data structures at ring 0 to hide malicious activity, operating far below the application layer rather than replacing app binaries.

Boot loader rootkits (bootkits) infect the Master Boot Record or bootloader to execute before the OS loads, not by targeting application-layer binaries with hooks or patches.