Hkboot — 2022

HKBoot 2022 is a specialized WinPE (Windows Preinstallation Environment) toolkit designed for IT professionals and PC enthusiasts to perform system recovery, disk management, and troubleshooting when an operating system fails to boot. Key Features & Capabilities

| Feature | HKBoot 2022 | Hiren’s BootCD PE (Western) | Sergei Strelec’s WinPE | | :--- | :--- | :--- | :--- | | Primary Audience | Hong Kong, China, SEA | Global | Russia, Europe | | Windows PE Version | Windows 11 & 10 & 7 (multi) | Windows 10 (single) | Windows 11 & 10 | | Linux Tools | Yes (Ubuntu/Porteus) | No | No | | Ghost/Batch Cloning | Norton Ghost + OneKey Ghost | No (DISM only) | Acronis True Image | | Legacy DOS Tools | Extensive (over 30) | Limited | Moderate | | Language | English & Chinese (Simplified/Traditional) | English only | English & Russian | hkboot 2022

HKBoot 2022: Key Highlights

2. Ransomware Human-Speed Response

A live, unscripted exercise simulated a ransomware deployment across a hybrid Azure AD / on-prem environment. The twist? The attackers used native Windows administrative tools (PsExec, WMIC, Scheduled Tasks). The winning team contained the blast radius in 17 minutes by leveraging custom PowerShell detectors—a technique now circulating in many local SOCs. HKBoot 2022 is a specialized WinPE (Windows Preinstallation

: Comes pre-loaded with "lite" versions of essential software, such as web browsers, office viewers, and antivirus tools, which run directly from the USB without installation. Multiboot Versatility KAPE (Kroll Artifact Parser & Extractor) Enhanced: While

: Scanning for viruses and checking for "bad sectors" on hard drives without needing an active OS. Data Rescue

Hardware Stress Testing: Includes utilities like Furmark for stress-testing graphics cards during repairs.

• KAPE (Kroll Artifact Parser & Extractor) Enhanced: While KAPE isn't new, the HKBoot team released a custom Targets and Modules pack specifically for Chinese messaging apps (WeChat, DingTalk) and local finance software.
• Velociraptor Deployments: The DFIR track dedicated four hours to Velociraptor, showing how to hunt for Cobalt Strike beacons across 10,000 endpoints using custom artifact definitions.
• Sysmon v14 Mastery: Deep dives into new Event IDs (specifically for DNS over HTTPS and WSL2 activity) were game-changers for attendees hunting Linux-based malware on Windows hosts.