rapid7/metasploit-framework — pull request #2108 by jiuweigui (2013-07-16 11:40:02+00:00)
Title: Feature/prefetch gather

This post module enumerates Windows prefetch files and gathers saved filename(from pf), run count(from pf), file path hash(from pf), modified & created (mace) timestamps, prints it out and saves it to a loot file. It also uses windows registry keys to gather information about the remote systems timezone and prefetcher settings. I've been able to test it on WinXP and Win7.