A short incident summary lists three behaviors: files encrypted with a demand note, browser history secretly uploaded, and a hidden privileged module. Which ordered labels match those behaviors?