Here is my link. I have run Sales.exe with VM.

hxxp://testweb[.]com/Sales-Invoice/
cc.pro/images.html
There is another threat, and that is at 
http]]://karlos .net/

tak a look at hxxp://block[.]de[.]com/malware.exe
Another threat is placed at  ghzz,com
