Sonoma malware control: “if a quarantined app arrives in a folder named Extras and that folder is moved to an Applications folder, then translocation is still expected”