I don't think you need to do this:

my $filename = $request->param('file');
my $filehandle = $request->upload( $filename );
[download]

According to the docs for CGI, 'the filename returned is also a filehandle', which sounds like serious voodoo to me. I can't test it on IIS here, but this normally works:

my $filename = $request->param('file');
binmode ($filename);
# etc
[download]

Hope this helps.