#pragma namespace ("\\\\.\\root\\cimv2")

class Win32_WMIForwardedMessageEvent : __ExtrinsicEvent 
{
    datetime Time;                          
    string Machine;
};

class Win32_WMIForwardedEvent : Win32_WMIForwardedMessageEvent
{
    __Event Event;
};

instance of __Win32Provider as $P
{
    Name = "Microsoft WMI Forwarding Event Provider";
    Clsid = "{7879E40D-9FB5-450a-8A6D-00C89F349FCE}";
};

instance of __EventProviderRegistration
{
    Provider = $P;
    EventQueryList = { "select * from Win32_WMIForwardedMessageEvent" };
};