Click on the image to zoom
Kernel Load Phase:
NTLDR initiates NTOSKRNL.EXE
Then the HAL (hardware abstraction layer ) is loaded that hides the physical hardware from applications
Next the SYSTEM hive is loaded and scanned for device drivers along with the services that need to be loaded. These are organized into groups and are loaded into memory but not initialized yet, in the order in which they appear in the ServiceGroupOrder subkey of the registry.
Kernel Initialization Phase:
The screen is blue, and the kernel and the drivers that were loaded during the kernel load phase are initialized. The kernel is initialized.
SYSTEM hive is scanned once again to assess which drivers should be loaded and then these are initialized.
