Normal
Don’t worry, it may not be necessary, I am looking for ransomware samples as well. When the desktop wallpaper is changed, that is a clear sign, isn’t it?