(I moved this to a different topic since you mention “PC” and the original topic was about opening AxCrypt files on a Mac)
If AxCrypt is being used, “sample.pdf” would become “sample-pdf.axx” not “sample.pdf.axx”, but perhaps that is what you mean.
If you are not using AxCrypt, or renaming the files yourself, someone else is.
There are reports of criminals using TeamViewer and guessing the password to users computers and then installing and encrypting files, and then demanding ransom. Typically this is done by leaving a file on the desktop with this message.