I have added a zipped pcap file for your analysis. The password for the zipped pcap is infected all lowercase.

PCAP file of the infection traffic:
2018-02-23-EITest-Hoefler-Text-pcap.zip

ASSOCIATED DOMAINS AND IP ADDRESSES:

• zaremedspa.com – COMPROMISED SITE
• 91.211.112.101 – teleduck.de GET /index_3.php – DOWNLOADER FOR NETSUPPORT MANAGER RAT
• 31.31.196.204 Port 443 – printscreens.info – NETSUPPORT MANAGER RAT POST INFECT TRAFFIC
• 94.242.198.167 Port 1488 – ebalodauna1488.com POST http://94.242.198.167/fakeurl.htm – NETSUPPORT MANAGER RAT POST INFECT TRAFFIC

IMAGES AND DETAILS OF INFECTION CHAIN:

Shown above: Network traffic associated with the EiTest campaign and Hoefler Text pop-up leading to NetSupport  Manager RAT

Shown above: DNS traffic associated with the EiTest campaign and Hoefler Text pop-up leading to NetSupport  Manager RAT

Shown above: First pop-up associated with Hoefler Text fake font

Shown above: Downloader associated with NetSupport Manager RAT downloaded from teleduck.de /index_3.php

MALICIOUS PAYLOAD ASSOCIATED WITH EITEST CAMPAIGN:

• Font_update.exe – NETSUPPORT RAT DOWNLOADER
  SHA-256 Hash: 9e23d5b5ccfd47ffb28b4a2a3ef96a93b1b595893022ad564c29c6cdc8e9f39f
  Virus Total Link
• q.js – JavaScript used to download NETSUPPORT RAT
  C:\Users\USERNAME\AppData\Local\Temp
  SHA-256 Hash: c9aef58c5a639778b2f83495d30a4a9466d79e70b2d089cffb9e1974d335b4ed
  Virus Total Link
• client32.exe – NETSUPPORT CLIENT
  C:\Users\USERNAME\AppData\Roaming\Dom
  SHA-256 Hash: c9aef58c5a639778b2f83495d30a4a9466d79e70b2d089cffb9e1974d335b4ed
  Virus Total Link