Comment by wheybags

To quote Raymond Chen: this exploit "rather involved being on the other side of this airtight hatchway"

If they didn't modify the config, they could presumably use one of a plethora of tactics to extract data directly from keepass.exe's memory.