I believe that the TIME_FORMAT value for this add-on is incorrect - more specifically, I believe that the trailing percentage sign (%) at the end needs to be removed.
Is someone who is more familiar with XML formatted Sysmon events able to confirm this?
