The TrickBot modules used for discovery include networkdll and psfin. TrickBot downloads modules for collecting local system information and scouting the network, primarily part of the networkdll module. This module has a battery of command line, WMI and LDAP queries to gather information, and then exfiltrate the data to GRIM SPIDER for review. The psfin module has a similar purpose but specifically searches for financial and point-of-sales indicators