It's correct. There is no virus. It's because Toec can elevate and impersonate users but obviously that's intentional. It's used for the new Winget functionality. The virus scanner is complaining about this file.
https://github.com/jdolny/Toec/blob/master/Toec-Services/ServiceRunAs.cs