Agenda ransomware Linux variant avoids encrypting files with the following strings in their file path:

/bin/
/boot/
/dev/
/etc/
/healthd/
/lib/
/lib64/
/mbr/
/proc/
/run/
/sys/
/vdtc/
/vmware/lifecycle/