@magicandre1981 I've followed the guide and did the recording but it took over 2 hrs to get to the state where the Commit Size was starting to grow for explorer.exe. After loading the ETL file (21GB) the WPA is very slow and every time I try to analyze the "heap dynamic allocations" it crashes... Any thoughts?

I'll try the method that HelpingHand suggested now and see where it gets me.

Thank you so much for all the help guys! :)

@HelpingHand Weirdest thing, I've tried killing the process and spawning a new one, it came back with a 14718 PID and later it disappeared and a new explorer.exe appeared with another PID ~_~

VMMap, of course, halted. I'll try killing it again and see what happens.

Ok so the issue seems to be that MS for some reason prevents running an elevated explorer.exe which what trips VMMap. The problem is, an "unelevated" explorer.exe is unable to launch other explorer.exe (when I click on the Start Menu and click the "Explorer") which shows the error message of:

[Window Title]
C:\Windows\explorer.exe

[Content]
Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.

[OK]

So to conclude:
1. Kill explorer.exe (OK)
2. Launch explorer.exe
Windows intercept the request and instead creates a task which runs:
"C:\Windows\explorer.exe /NOUACCHECK"
3. The PID is changed and VMMap is unable to continue monitoring the process