Many AVs (including Windows Defender) flag Troxill as HackTool:Java/Minecraft . This is a common to all utility mods because the client injects code into the JVM. However, if your AV flags Trojan:Win32/Wacatac , do not run it—that is a real infection.
Reply below and I’ll help out. Stay safe and happy mining! ⛏️ Troxill Client for Minecraft 1.16.5