KeeFarce is a memory extraction tool designed to retrieve cleartext password database information from running KeePass 2.x processes. The tool operates by injecting a DLL into the target KeePass process to execute code within its context. It uses a bootstrap DLL to spawn a .NET runtime instance within the appropriate application domain, then executes the main C# payload (KeeFarceDLL.dll). The extraction process utilizes CLRMD (Common Language Runtime Memory Diagnostics) to locate necessary objects within the KeePass process heap. It identifies pointers to required sub-objects using memory offsets and employs reflection to call export methods for data retrieval. Extracted information includes usernames, passwords, notes, and URLs, which are exported to a CSV file stored in the %AppData% directory. The tool requires architecture-specific builds to match the target KeePass process (32-bit or 64-bit). For execution, four files must be present in the same directory: BootstrapDLL.dll, KeeFarce.exe, KeeFarceDLL.dll, and Microsoft.Diagnostic.Runtime.dll. The tool is designed for post-exploitation scenarios where an attacker has already gained access to a system running KeePass.