These files look real to ransomware but contain fake content. Any write, rename, or delete by another process fires an instant alarm and TreeIQ kills the attacker before more files are touched. Don't move or edit them.