@strings = split(/\x00/,$evt_h->{Strings});
foreach $piece (@strings) {
	print ("string-$piece\n");
}

print ("$strings[2]\n");
$mysid=$strings[2];
#tried this to strip off the %,{,} but it didn't help
#$mysid =~ s/[\%{}]//g;
print ("mysid: $mysid\n");

if Win32::LookupAccountSID($nodename,$strings[2],$account,$domain,$sidtype)) 
{
	print ("Account: $account\n");
	print (" Domain: $domain\n");
	print ("SIDType: $sidtype\n");
} else {
	print ("LookupAccountSID Error\n");
}