Agenda ransomware GO variant avoids encrypting files with the following strings in their file names:

#recycle
autorun.inf
autorun.ini
boot.ini
boot.ini
bootfont.bin
bootfont.bin
bootmgfw.efi
bootmgr
bootmgr.efi
bootsect.bak
bootsect.bak
desktop.ini
desktop.ini
iconcache.db
iconcache.db
ntldr
ntldr
ntuser.dat
ntuser.dat
ntuser.dat.log
ntuser.dat.log
ntuser.ini
ntuser.ini
thumbs.db
thumbs.db
$recycle.bin
$recycle.bin
$windows.~bt
$windows.~ws
all users
appdata
appdata
application data
boot
boot
config.msi
default
google
intel
mozilla
msocache
perflogs
program files
program files (x86)
programdata
public
system volume information
tor browser
windows
windows
windows.old
windows.old