You have done the sensible tests, but it looks like an OS bug, so you'll need to wait for an update. It's something I do reluctantly, but if you kill explorer.exe it will restart and the OS will continue running, although your desktop will be messed up, especially the system tray (missing and reordered icons). Sometimes Explorer crashes without my having to do it manually, and it nearly always gives an error on shutting down during a restart. I have learned to live with it, though I have not noticed any significant change since 1709.

@AFH Are you experiencing the same issue ever since moving to 1709? or you're saying that you've noticed this happening in previous builds as well?

What timeframe causes a noticeable memory bump? Minutes? I would recommend using the windows performance recorder to record an etl file of explorer.exe (blogs.technet.microsoft.com/yongrhee/2015/08/04/…) and then analyze it. This is not a trivial task and may require deep understanding of system calls and some tuning.

I have been having random crashes of Explorer ever since XP, but as I said, I haven't noticed that much difference with 1709, though these days my day-to-day OS is Ubuntu, so I am now using Win10 and Explorer a lot less than I used to.

Just an aside, be careful about the term "Memory Leak", because to a programmer/maintainer, that is a very specific kind of flaw in a program that is fixed in a specific set of ways (that all come back to deallocating memory that is no longer being used). this is distinct in cause from cases where a program just uses a lot of RAM, perhaps for bad reasons that have nothing to do with the programmer or runtime failing to deallocate memory that is no longer needed.

use Windows Performance Toolkit and measure ReferenceSet and analyze it

@Samuel The anomaly starts as soon as you boot up, it usually takes around 48 hours to get to 5GB (Working Set).

@AFH I have 32GB of RAM so luckly nothing crashes, but around 7 days of uptime causes the system to become very slow and requires a restart.

@FrankThomas do you have a suggestion on how I should name my question to better reflect the meaning?

@magicandre1981 I would appriciate a more in-depth list of instructions on how to acheive my goal of finding the cause of the anomaly. Thank you!

@Aternus - As I said you need only kill Explorer (quickest, but with side-effects), though log off and on will be more orderly and quicker than a full restart, but all processes running in the session will terminate and need to restart.

the link explains everything. Win10 includes wpr.exe, open CMD.exe as admin, run this command wpr.exe -start ReferenceSet -filemode && timeout -1 && wpr.exe -stop C:\HighMemoryUsage.etl, wait 3 minutes to capture the memory usage grow, press a key to stop logging. Zip the large ETL file (+ NGENPDB folder) into 1 zip, upload the zip (OneDrive, dropbox, google drive) and post the share link here.

Just going back to Process Explorer, can you add the the lower pane, and choose to show DLLs. Then add the columns to the lower pane from the DLL, Process Memory tab, you can then choose - File Save As and save that to file. Maybe link that here. Also, you could download VMMap (Sysinternals), select the Explorer process and save the information to explorer.mmp and link that file here.

@HelpingHand Here is a OneDrive link to a folder with all the files - 1drv.ms/f/s!AoUGGsMzm_U8kmYhwRbTYrWuRXLE - I've refreshed the memory map 3 times so that you can see the changes, so far it seems the problem is with the Heap

it shows high heap usage. without callstacks of allocations from the ETL we can't help you

@magicandre1981 The ETL file is in the shared folder - 1drv.ms/f/s!AoUGGsMzm_U8kmYhwRbTYrWuRXLE - The recording includes 20min of usage starting from a fresh boot up. -- As soon as explorer.exe starts exceeding 100MB of RAM I'll record again and post it together with a fresh Process Explorer TXT and a Memory Map. Thank you so much for your help! I've learned quite a lot.

@magicandre1981 round-2 folder includes the new explorer.exe txt, memory map and the ETL all from a single session with the anomaly happening.

the grow is very low in the trace. from what I see the Explorer allocates memory while trying to start programs (shell32.dll!HDXA_LetHandlerProcessCommandEx, windows.storage.dll!CBindAndInvokeStaticVerb::_TryExecuteCom‌​mandHandler, shell32.dll!COpenDefaultLocationCommand::Execute) and querying ContextMenus (shell32.dll!CRegistryVerbsContextMenu::QueryContextMenu) which results in searches to Windows Search (StructuredQuery.dll!StructuredQuery1::CStructuredQueryHelpe‌​r::ParseStructured‌​Qu‌​ery, StructuredQuery.dll!StructuredQuery1::LoadSchemaBinaryFromFi‌​le) and this causes allocations.

StructuredQuery.dll!SemanticsUM::SchemaBinary::Load, StructuredQuery.dll!operator new. And the new operator does the HEap allocations. how large is the search index? try to rebuild it.

Let us continue this discussion in chat.

While there was a missing folder listed in the Indexing Cache (which was removed), unfortunately, clearing the Indexing Cache didn't solve the problem, here is a round 3 of the files: 1drv.ms/f/s!AoUGGsMzm_U8knC281BOjvrZ07QK

@HelpingHand @magicandre1981 any chance you could help out with the final stretch of finding the cause?

I still have no idea. last file still doesn't show large grow.

@magicandre1981 In the memory map I keep noticing 16,192KB sections being added and not freed-up, maybe there is a way to see how much memory is being allocated and find what causes that exact sum allocation?