You’re welcome.

Yes it is strange, but I think that is down to the checking against a cloud database (Reputation Services, I think) of known files in aggressive mode (not in moderate mode) and that may well make the difference when the file is known. The aggressive mode also overrides the DeepScreen which may also have had an effect, it also allows for exceptions if the file happens to be pinged.