upload is clean. it was discussed here before.
the plugin contains a serialized code to check for license. it should be removed from the file, as it is useless.
PHP:
eval( "\162\x65\161\x75\x69\x72\145\x5f\157\x6e\x63\145\x20\x70\x6c\x75\147\151\156\137\144\x69\x72\x5f\x70\141\164\x68\x28\x20\x24\x66\x69\x6c\x65\40\51\40\x2e\40\47\x6c\151\142\x2f\x77\160\x2d\x70\x61\x63\153\x61\x67\x65\55\x75\160\x64\141\164\145\162\57\143\x6c\x61\163\x73\55\167\x70\x2d\160\141\x63\153\141\147\x65\55\165\160\x64\x61\164\x65\162\x2e\x70\x68\160\x27\73\xa\12\x24\x68\x61\156\x64\x6c\x5f\x75\x74\x6d\137\147\x72\141\x62\x62\x65\x72\137\165\160\x64\141\164\145\162\x20\x3d\40\x6e\x65\x77\x20\x57\x50\137\x50\141\x63\153\141\x67\145\x5f\x55\x70\x64\x61\x74\x65\x72\x28\xa\x27\150\164\x74\160\163\72\x2f\57\x61\x70\x69\56\x68\x61\156\144\154\x64\151\x67\151\164\141\x6c\x2e\143\157\155\x2f\x68\x74\x74\160\57\x6c\151\x63\145\x6e\x73\145\x27\x2c\xa\167\160\x5f\x6e\157\x72\x6d\x61\x6c\x69\x7a\x65\x5f\x70\141\164\x68\50\x20\44\x66\151\154\145\x20\51\54\12\x77\x70\137\x6e\157\x72\155\x61\x6c\x69\x7a\x65\137\x70\141\x74\x68\50\40\160\154\165\147\x69\x6e\137\144\151\x72\x5f\160\x61\x74\150\50\40\x24\146\151\x6c\x65\x20\51\x20\x29\54\12\164\x72\x75\x65\12\x29\73");
here is the zip without the aforementioned lines:
handl-utm-grabber-v3-v3052.zip
Securely upload your files, media and documents to more than 30 cloud storage providers simultaneosuly. Remote Upload files to Google Drive and many other hosts.
www.mirrored.to
Scan results:
virusscan.jotti.org
VirusTotal
www.virustotal.com
Also, always scan your wordpress regularly with GOTMLS plugin, especially afteryou install a nulled plugin or anything of the sort.
Why it's shows windows's denfender?