Which two methods does the Cortex XDR agent use to identify malware during a scheduled scan? (Choose two.)