Wizard Spider has used networkdll for network discovery and psfin specifically for financial and point of sale indicators. Wizard Spider has also used AdFind and "nltest/dclist" to enumerate domain computers, including the domain controller.