Just for clarification, I see no endpoint security events that point to the shared memory operations.