Many programs create virtual disks that are initiated first in the start-up line. It would seem pointless starting a system vitalization process after other processes have already been engaged, especially if they are of malicious intent! So I can only assume programs that set-up virtual environments like Shadow Defender, Deep Freeze, Time Machine, Returnil, WTF etc, do so before any other programs are executed at start-up. If my assumption is correct, then if more than one is enabled at the same time, who would get in first! It is a rhetorical question really. The real question is can any other program be loaded, executed and even have internet access before the virtual program kicks in at start up? Could one be stealthy working on your real OS in the background, while you work in the virtual environment unaware of what is happening in the real environment, because it got in first—before the virtual session was started! It might even have delayed the implementation of that virtual environment session for a few seconds to give it time to make a stealthy internet connection! Really a discussion more than a question!