Hi Sid, I cant quite figure out where those characters are coming from, but for the event ID bit, this should fix it:

    foreach my $key (keys %$hashRef){
    if ($key =~ /EventID/) {
        my $id = ($hashRef->{$key} & 0xffff);
            print $key . "\t" . "\"$id\"" . "\n";
    }
[download]

hth !!

Update:
Ok, I am seeing the chars being printed against the name field. I still dont know how to fix it to print the name field, but this should give you the sid for the uid instead.

elsif ($key =~ /User/){
    my $sid = unpack("H" . 2 * length(${$hashRef}{$key}), ${$hashRef}{
+$key});
    my $user = ($hashRef->{$key} & 0xffff);
    print "User SID: " . "\t" . "\"$sid\" " . "\n";
}
[download]