Contact Microsoft engineer help to debug as following, cloud you help to analyze and resolve ASAP, THX.

1、explorer.EXE's exit is not its own cause, it should be terminated by other process. Check out this dump and find that the problem occurs during the boot start phase.

Debug session time: Tue Nov 13 08:39:08.000 2018 (UTC + 8:00)
System Uptime: 0 days 0:00:48.630
Process Uptime: 0 days 0:00:39.000

2、Debug from the explorer.exe dump file: Explorer.EXE performs its own operation and is then logged to exit by the tool, which itself does not execute the ExitProcess function.

0:000> KL
     # Child-SP          RetAddr           Call Site
00 00000000`11eaf978 00007ffa`77ad13ed ntdll!ZwWaitForMultipleObjects+0xa
01 00000000`11eaf980 00007ffa`7819106f KERNELBASE!WaitForMultipleObjectsEx+0xe1
02 00000000`11eafc60 00007ffa`69da2048 kernel32!WaitForMultipleObjects+0xf
03 00000000`11eafca0 00007ffa`781913d2 msiltcfg!WorkerThread+0x68
04 00000000`11eafd20 00007ffa`7a5b54f4 kernel32!BaseThreadInitThunk+0x22
05 00000000`11eafd50 00000000`00000000 ntdll!RtlUserThreadStart+0x34

3、Debug from the OpenStackService.exe dump file: Explorer.EXE is actually being closed by the openstackservice.EXE.
From the following callstack, we see that Openstackservice called the terminateprocess function to kill the explorer.Exe.

0:000> !mex.t
DbgID ThreadID     User Kernel
0     45c (0n1116)   0s     0s
# Child-SP         Return           Call Site                                  Source
0 000000681253a4d8 00007ffa7a641fe0 ntdll!ZwWaitForSingleObject+0xa            
1 000000681253a4e0 00007ffa77af2e7e ntdll!RtlReportSilentProcessExit+0x89cb0  
2 000000681253b080 00007ff69955163c KERNELBASE!TerminateProcess+0x1a  =====》OpenStackService call TerminateProcess to kill explorer.exe
3 000000681253b0b0 00007ff6995515d6 OpenStackService+0x163c 
4 000000681253b330 00007ff6995515d6 OpenStackService+0x15d6 
5 000000681253b5b0 00007ff6995515d6 OpenStackService+0x15d6 
6 000000681253b830 00007ff6995515d6 OpenStackService+0x15d6 
7 000000681253bab0 00007ff699551716 OpenStackService+0x15d6 
8 000000681253bd30 00007ff6995519e9 OpenStackService+0x1716 
9 000000681253bda0 00007ffa7a56a3d2 OpenStackService+0x19e9 
a 000000681253bde0 00007ffa7a545ff9 sechost!ScDispatcherLoop+0x5ec            
b 000000681253bef0 00007ff699551177 sechost!StartServiceCtrlDispatcherW+0x50   
c 000000681253bf30 00007ff6995524cc OpenStackService+0x1177 
d 000000681253fcf0 00007ffa781913d2 OpenStackService+0x24cc 
e 000000681253fd30 00007ffa7a5b54f4 kernel32!BaseThreadInitThunk+0x22          
f 000000681253fd60 0000000000000000 ntdll!RtlUserThreadStart+0x34     

4、View the call stack, the terminated process has a PID of 0x78c.And 0x78c is our explorer.EXE process.

stack(s) with 3 threads displayed (3 Total threads)
0:000> dx Debugger.Sessions[0].Processes[1168].Threads[1116].Stack.Frames[1].SwitchTo();dv /t /v
Debugger.Sessions[0].Processes[1168].Threads[1116].Stack.Frames[1].SwitchTo()
<unavailable>     void * ExitingProcessIn = <value unavailable>
@r14d             unsigned long ExitStatus = 1
@ebx              unsigned long ExitingProcessId = 0x78c

0:000> !mex.p
Name         Ses PID          PEB              Mods Handle Active Thrds
============ === ============ ================ ==== ====== ============
explorer.exe   1 78c (0n1932) 00007ff7ee34d000  143      3            1

CommandLine: C:\Windows\Explorer.EXE