Agenda Ransomware GO variant avoids encrypting files with the following extensions:

.386
.adv
.ani
.bat
.bin
.cmd
.com
.cpl
.cur
.deskthemepack
.diagcab
.diagcfg
.diapkg
.dll
.drv
.exe
.hlp
.hta
.icl
.icns
.ico
.ics
.idx
.key
.ldf
.lnk
.lock
.mod
.mpa
.msc
.msi
.msp
.msstyles
.msu
.nls
.nomedia
.ocx
.pdb
.prf
.ps1
.QiFzQQRPXt
.rom
.rtp
.scr
.shs
.spl
.sys
.theme
.themepack
.wpx