Build lime, dump RAM, build Volatility profile (Hal Pomeranz's Linux Memory Grabber is better)