def clean(self, context, connection):
        """Checks for database export + malicious trigger on the remote host, removes everything"""
        # if the specified path is %APPDATA%, we need to check in every user's folder
        if self.export_path == "%APPDATA%" or self.export_path == "%appdata%":
            poll_export_command_str = "powershell.exe \"Get-LocalUser | Where {{ $_.Enabled -eq $True }} | select name | ForEach-Object {{ Write-Output ('C:\\Users\\'+$_.Name+'\\AppData\\Roaming\\{}')}} | ForEach-Object {{ if (Test-Path $_ -PathType leaf){{ Write-Output $_ }}}}\"".format(self.export_name)
        else:
            export_full_path = f"'{self.export_path}\\{self.export_name}'"
            poll_export_command_str = 'powershell.exe "if (Test-Path {} -PathType leaf){{ Write-Output {} }}"'.format(export_full_path, export_full_path)
        poll_export_command_output = connection.execute(poll_export_command_str, True)

        # deletes every export found on the remote machine
        if self.export_name in poll_export_command_output:
            # in case multiple exports found (may happen if several users exported the database to their APPDATA)
            for export_path in poll_export_command_output.split("\r\n"):
                context.log.display(f"Database export found in '{export_path}', removing")
                remove_export_command_str = f"powershell.exe Remove-Item {export_path}"
                connection.execute(remove_export_command_str, True)
        else:
            context.log.display(f"No export found in {self.export_path} , everything is cleaned")

        # if the malicious trigger was not self-deleted, deletes it
        if self.trigger_added(context, connection):
            # prepare the trigger deletion script based on user-specified parameters (e.g: trigger name, etc)
            # see data/keepass_trigger_module/RemoveKeePassTrigger.ps1
            self.remove_trigger_script_str = self.remove_trigger_script_str.replace("REPLACE_ME_KeePassXMLPath", self.keepass_config_path)
            self.remove_trigger_script_str = self.remove_trigger_script_str.replace("REPLACE_ME_TriggerName", self.trigger_name)

            # actually performs trigger deletion
            if self.powershell_exec_method == "ENCODE":
                remove_trigger_script_b64 = b64encode(self.remove_trigger_script_str.encode("UTF-16LE")).decode("utf-8")
                remove_trigger_script_command_str = f"powershell.exe -e {remove_trigger_script_b64}"
                connection.execute(remove_trigger_script_command_str, True)
            elif self.powershell_exec_method == "PS1":
                try:
                    self.put_file_execute_delete(context, connection, self.remove_trigger_script_str)
                except Exception as e:
                    context.log.fail(f"Error while deleting trigger, exiting: {e}")
                    sys.exit(1)

            # check if the specified KeePass configuration file does not contain the malicious trigger anymore
            if self.trigger_added(context, connection):
                context.log.fail(f"Unknown error while removing trigger '{self.trigger_name}', exiting")
            else:
                context.log.display(f"Found trigger '{self.trigger_name}' in configuration file, removing")
        else:
            context.log.success(f"No trigger '{self.trigger_name}' found in '{self.keepass_config_path}', skipping")
Checks for database export + malicious trigger on the remote host, removes everything
cme/modules/keepass_trigger.py