ntoskrnl.exe (short for Windows NT operating system kernel executable), also known as the kernel image, contains the kernel and executive layers of the
and the executive are linked together into the single loaded module ntoskrnl.exe; from outside this module, there is little distinction between the kernel
Boot Manager invokes winload.exe—the operating system boot loader—to load the operating system kernel executive (ntoskrnl.exe) and core device drivers. In
up the low-level kernel-mode portion, and are contained in the file NTOSKRNL.EXE. It deals with I/O, object management, security and process management