Agenda Ransomware GO variant encrypts files found in the following folders:

$recycle.bin
$recycle.bin
$windows.~bt
$windows.~ws
all users
appdata
appdata
application data
boot
boot
config.msi
default
google
intel
mozilla
msocache
perflogs
program files
program files (x86)
programdata
public
system volume information
tor browser
windows
windows
windows.old
windows.old