During the analysis phase of an active malware incident, an analyst plans to collect forensic evidence from a compromised Windows workstation that is still powered on and connected to the network. The analyst wants to preserve the most fragile evidence first to avoid data loss. Which source should the analyst collect FIRST according to the order of volatility?