how can I find this "\\.\pipe\shell.em" pipe on windows?

Use https://stackoverflow.com/questions/258701/how-can-i-get-a-list-of-all-open-named-pipes-in-windows. I found it is easier to launch osqueryi/osqueryd with known socket name. --extensions_socket=\\.\my_own_osquery.em