Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

Renames multiple (8528) files with added filename extension

This suggests ransomware activity of encrypting all the files on the system.

Renames multiple (8547) files with added filename extension

This suggests ransomware activity of encrypting all the files on the system.

Modifies Installed Components in the registry

Modifies extensions of user files

Ransomware generally changes the extension on encrypted files.