UiPath.Assistant.exe and UiPath.Executor.exe invokes vbs.exe and is blocked by antivirus as CustomEnterpriseBlock malware

Help Apps
1

Defender detected and quarantined active ‘EUS:Win32/CustomEnterpriseBlock!cl’ in file ‘vbc.exe’, during attempted open by ‘UiPath.Executor.exe’.

Event UiPath.Executor.exe created a downloaded file hcjymubp.dll from 127.0.0.1

event entities chart:
UiPath.RobotJS.UserHost.exe (SHA1: 2f76f1a5263776f11100eddea082f5f229d87a1c)
|
|–> UiPath.Service.UserHost.exe (SHA1: f0cad34c39da8a81683e81e3740163f45c6119d6)
…|
…|–>UiPath.Executor.exe (SHA1: f31fd78692a8cdd419bd95224649b69e48f62b4d)
…|
…|–> created file hcjymubp.dll. Full Path: C:\Users\yfon\AppData\Local\Temp\hcjymubp.cmdline
…|–> “vbc.exe” /noconfig @“C:\Users\yfonseca\AppData\Local\Temp\hcjymubp.cmdline”

Full VBS executable path:
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

We want to know if it is normal that the UiPath.Executor.exe process creates temporary cmdline files, and then they are executed by VisualBasic?