Windows assumes that physical memory has no cost associated with using it. It makes no effort whatsoever to make physical memory free because this makes no sense. If it makes physical memory free, only one of two things can happen:
That memory isn't used any time soon. In this case, the effort of making it free was wasted.
That memory is used soon. In this case, the effort of making it free was harmful, as now the system simply has to undo that work to use the memory.
Modern operating systems only make physical memory free if they have absolutely no other possible choice.
If you're thinking "I need memory free now so I can use it later", forget it. You can use memory now and use it later. There's no painful tradeoff that you have to make here.
Everything is fine.
If you want a more detailed understanding of how physical memory is being used on your system, try RAMMap.
You have a memory leak caused by a driver. Look at the high value of nonpaged kernel memory. In your case this is over 3.7 GB. You can use poolmon to see which driver is causing the high usage.
Install the Windows WDK, run poolmon, sort it via P after pool type so that non paged is on top and via B after bytes to see the tag which uses most memory. Run poolmon by going to the folder where WDK is installed, go to Tools (or C:\Program Files (x86)\Windows Kits\10\Tools\x64) and click poolmon.exe.
Now see which pooltag uses most memory as shown here:
Now open a cmd prompt and run the findstr command. To do this, open cmd prompt and type cd C:\Windows\System32\drivers. Then type findstr /s __ *.*, where __ is the tag (left-most name in poolmon).
Do this to see which driver uses this tag:
Now, go to the drivers folder (C:\Windows\System32\drivers) and right-click the driver in question (intmsd.sys in the above image example). Click Properties, go to the details tab to find the Product Name. Look for an update for that product.
If the pooltag only shows Windows drivers or is listed in the pooltag.txt ("C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\triage\pooltag.txt")
you have use xperf to trace what causes the usage. Install the WPT from the Windows SDK, open a cmd.exe as admin and run this:
xperf -on PROC_THREAD+LOADER+POOL -stackwalk
PoolAlloc+PoolFree+PoolAllocSession+PoolFreeSession -BufferSize 2048
-MaxFile 1024 -FileMode Circular && timeout -1 && xperf -d C:\pool.etl
capture 30 -60s of the grow. Open the ETL with WPA.exe, add the Pool graphs to the analysis pane.
Put the pooltag column at first place and add the stack column. Now load the symbols inside WPA.exe and expand the stack of the tag that you saw in poolmon.
Now find other 3rd party drivers which you can see in the stack. Here the Thre tag (Thread) is used by AVKCl.exe from G-Data. Look for driver/program updates to fix it.
The user Hristo Hristov provided a trace with a high FMfn usage during unzipping files:
The tag is used by the driver WiseFs64.sys which is part of the "Wise Folder Hider" program. Removing it fixes the leak.
The user Samuil Dichev provided a trace with a high FMic and Irp usage
The tags are used by the program Razor Cortex.
In the sample of the user chr0n0ss the FMic and Irp usage is caused by F-Secure Antivirus Suite:
Removing it and using Windows Defender fixed the issue for him.
Best Answer
Use Resource Monitor to see detailed memory usage. In Task Manager navigate to Performance tab and click on "Resource Monitor..." at the bottom of the window. In Resource Monitor window navigate to Memory tab. There you'll see four columns: Commit (KB), Working Set (KB), Shareable (KB), Private (KB). Apparently Task Manager Processes tab shows only Private memory usage.